Domain name generation method, domain name detection method, and electronic device, storage medium

Abstract

A domain name generation method, a domain name detection method, and an electronic device and a storage medium. The domain name generation method comprises: querying a target domain name from one or more domain name resolvers, so that the domain name server record corresponding to the target domain name is cached in the one or more domain name resolvers; obtaining the cache validity period of the domain name server record of the target domain name in the one or more domain name resolvers; authorizing a new domain name based on the target domain name at the domain name server corresponding to the target domain name and the domain name server resource record of the new domain name, wherein the new domain name is a subdomain name of the target domain name; before the cache validity period expires, querying the new domain name generated based on the target domain name from the one or more domain name resolvers, so that the one or more domain name resolvers cache the domain name server record of the new domain name. The domain name generation method can make the newly generated domain name survive continuously, thereby guaranteeing the normal performance of domain name resolution, and has the advantages of simple operation, low cost, wide application object, etc.

Description

Technical Field

[0001] Embodiments of this disclosure relate to a domain name generation method, a domain name detection method, an electronic device, and a storage medium. Background Technology

[0002] A domain name is a name that is easy for people to remember and is used to identify a computer's location during network data transmission, making it easier for people to access the Internet. There is a specific correspondence between domain names and computer IP addresses. After the Domain Name System (DNS) resolves a domain name, it can find the corresponding IP address, thus converting the domain name into a machine-readable IP address.

[0003] Domain names, as a key foundational application in today's internet, decisively influence numerous other network applications and protocols, including website access, content distribution, email sending and receiving, certificate application, and blacklist deployment.

[0004] However, domain names are frequently misused in various online activities, such as botnets, phishing attacks, and malicious emails. According to the Internet Corporation for Assigned Names and Numbers (ICANN), approximately 620,000 domain names were misused and posed security threats in March 2023. As a countermeasure, internet regulators use methods such as domain name revocation to handle malicious domain names in compliance with regulations, cutting off the operational chain of malicious online activities. To identify malicious domain names in real time, regulators need to know how these domains are generated.

[0005] Domain name generation algorithms are a common method for generating domain names. These algorithms use specific programming techniques to generate a large number of domain names for use. However, these algorithms rely on existing, normally registered domains to generate new ones. Once a registered domain expires or is revoked, it cannot be used to generate a new domain. Therefore, it is necessary to continuously register domains and pay registration fees, annual fees, etc.

[0006] Domain name generation algorithms are also frequently used for communication in botnets and malware. For example, pre-built algorithms can generate a large number of repeatedly registered domain names, which can then be used to generate a massive number of malicious domains. This vast number of malicious domains enables covert communication and evasion of regulation. Because domain names generated by these algorithms exhibit relatively fixed patterns, such as randomness, time sensitivity, similar formats, short domain lifespans, and unresolvable domains, network regulators can identify malicious domains based on their format or other pattern characteristics, or predict them using reverse domain name generation algorithms. Summary of the Invention

[0007] At least one embodiment of this disclosure provides a domain name generation method, comprising: querying one or more domain name resolvers for a target domain name, such that the domain name server record corresponding to the target domain name is cached in the one or more domain name resolvers; obtaining the cache validity period of the domain name server record of the target domain name in the one or more domain name resolvers; authorizing a new domain name and the domain name server resource record of the new domain name at the domain name server corresponding to the target domain name based on the target domain name, wherein the new domain name is a subdomain of the target domain name; and before the cache validity period expires, querying the one or more domain name resolvers for the new domain name generated based on the target domain name, so that the one or more domain name resolvers cache the domain name server record of the new domain name.

[0008] For example, in the domain name generation method provided in at least one embodiment of this disclosure, the level of the target domain name is N, where N is a positive integer greater than 1 and less than 128.

[0009] For example, in the domain name generation method provided in at least one embodiment of this disclosure, the target domain name includes a registered domain name, a normal domain name, an expired domain name, a faulty domain name, or a revoked domain name.

[0010] For example, in at least one embodiment of the domain name generation method provided in this disclosure, obtaining the cache validity period of the domain name server record of the target domain name in the one or more domain name resolvers includes: querying the one or more domain name resolvers for the domain name server record of the target domain name; receiving a response from the one or more domain name resolvers, the response including the cache validity period of the domain name server record in the one or more domain name resolvers.

[0011] For example, in at least one embodiment of the domain name generation method provided in this disclosure, the step of authorizing a new domain name and the domain name server resource record of the new domain name at the domain name server corresponding to the target domain name based on the target domain name includes: adding a prefix to the target domain name to generate the new domain name; setting an authorized resource record of the new domain name at the domain name server corresponding to the target domain name, wherein the authorized resource record includes the domain name server resource record and glue resource record of the new domain name.

[0012] At least one embodiment of this disclosure also provides a domain name detection method, including: querying whether there is a domain name server resource record for a target domain name to be detected in the cache of a domain name resolver; in response to the existence of a domain name server resource record for the target domain name to be detected in the cache of the domain name resolver, detecting whether there are domain name server resource records for the parent domain name to the M-th level parent domain name of the target domain name to be detected in the cache of the domain name resolver, where M is a positive integer greater than or equal to 1 and less than 128; and outputting the detection result of the target domain name to be detected.

[0013] For example, at least one embodiment of the domain name detection method provided in this disclosure further includes: obtaining a domain name to be detected; determining whether the domain name to be detected needs to be identified as the target domain name to be detected based on the level of the domain name to be detected; if the level of the domain name to be detected exceeds a threshold level, then the domain name to be detected is identified as the target domain name to be detected.

[0014] For example, at least one embodiment of the domain name detection method provided in this disclosure further includes: determining the processing method for the target domain name based on the detection result of the target domain name to be detected; if the detection result of the target domain name to be detected shows that there are domain name server resource records from the parent domain name to the M-level parent domain name of the target domain name to be detected in the cache of the domain name resolver, then issuing a warning or detecting whether the target domain name to be detected is a malicious domain name; in response to the target domain name to be detected being a malicious domain name, deleting the content related to the target domain name to be detected in the cache of the domain name resolver, or adding the target domain name to the domain name blacklist for network operators to handle.

[0015] At least one embodiment of this disclosure also provides an electronic device, including: a memory that non-transitoryly stores computer-executable instructions; and a processor configured to run the computer-executable instructions, wherein the computer-executable instructions, when run by the processor, implement the domain name generation method or the domain name detection method provided in any embodiment of this disclosure.

[0016] At least one embodiment of this disclosure also provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, implement the domain name generation method or the domain name detection method provided in any embodiment of this disclosure. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the accompanying drawings of the embodiments will be briefly described below. Obviously, the drawings described below only relate to some embodiments of this disclosure and are not intended to limit this disclosure.

[0018] Figure 1 This is a schematic diagram of the recursive resolution process of a domain name system.

[0019] Figure 2 This is a schematic diagram of an exemplary resource record;

[0020] Figure 3 A schematic diagram illustrating the process of maintaining a domain name's continuous existence, provided for at least one embodiment of this disclosure;

[0021] Figure 4 A schematic diagram illustrating a domain name generation method provided in at least one embodiment of this disclosure;

[0022] Figure 5 A flowchart illustrating an exemplary domain name generation method provided for at least one embodiment of this disclosure;

[0023] Figure 6 A schematic diagram illustrating a domain name detection method provided in at least one embodiment of this disclosure;

[0024] Figure 7 This is a schematic diagram illustrating a method for predicting malicious domain names in a domain name detection method provided in at least one embodiment of this disclosure;

[0025] Figure 8 This is a schematic diagram illustrating the method for handling malicious domain names in at least one embodiment of the domain name detection method provided in this disclosure;

[0026] Figure 9 A schematic diagram of the structure of an electronic device provided in at least one embodiment of this disclosure; and

[0027] Figure 10 A schematic diagram of a non-transitory computer-readable storage medium provided for at least one embodiment of the present disclosure. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this disclosure. All other embodiments obtained by those skilled in the art based on the described embodiments of this disclosure without creative effort are within the scope of protection of this disclosure.

[0029] Unless otherwise defined, the technical or scientific terms used in this disclosure shall have the ordinary meaning understood by one of ordinary skill in the art to which this disclosure pertains. The terms “first,” “second,” and similar terms used in this disclosure do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as “comprising” or “including” mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, without excluding other elements or objects. Terms such as “connected” or “linked” are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as “upper,” “lower,” “left,” and “right” are used only to indicate relative positional relationships, and these relative positional relationships may change accordingly when the absolute position of the described objects changes.

[0030] The present disclosure will now be described through several specific embodiments. To keep the following description of the embodiments of the present disclosure clear and concise, detailed descriptions of known functions and known components may be omitted. When any component of an embodiment of the present disclosure appears in more than one drawing, that component is represented by the same or similar reference numerals in each drawing.

[0031] A domain name consists of a string of dots separated by periods, including the domain body and the domain suffix. For example, the domain example.com has "example" as the domain body and ".com" as the domain suffix. The domain body typically contains the organization name or website name, indicating the domain owner or website content; the domain suffix usually indicates the type of organization or the country or region where the domain is located. The domain name space is a hierarchical structure, divided from top to bottom into root domains, top-level domains (first-level domains), second-level domains, third-level domains, and more. For example, "." is the root domain, ".com" is the first-level domain, "example.com" is the second-level domain, and "a1.example.com" is the third-level domain. It should be noted that the last dot "." in a domain name is generally omitted, so "example.com" should actually be represented as "example.com.", and "a1.example.com" should actually be represented as "a1.example.com.". In the embodiments of this disclosure, the last dot "." in the domain name is omitted for simplicity.

[0032] Adding a prefix to a domain name creates a subdomain. For example, a1.example.com is a subdomain of example.com, and a2.a1.example.com is a subdomain of a1.example.com. Larger websites often have multiple levels of domains. Domain names need to be registered and filed before they can be used. Generally, users can register second-level domains. Third-level domains, as subdomains of second-level domains, usually don't need to be registered separately because once the parent domain is registered, the subdomain can be directly authorized and resolved by the parent domain's name server.

[0033] A Domain Name Server (DNS) is a server used to translate domain names into their corresponding IP addresses. A DNS server maintains a table that resolves domain names and their corresponding IP addresses. Users can obtain the IP address corresponding to a domain name by querying the mapping relationship between domain names and IP addresses recorded in the table.

[0034] like Figure 1As shown, corresponding to the hierarchy of the domain name space, according to the domain name information mainly stored by the domain name server and its role in the domain name resolution process, domain name servers can be divided into root domain name servers, top-level domain name servers, and authoritative domain name servers.

[0035] Root name servers are the most important name servers. Currently, there are 13 root name servers deployed in the global Internet, and each root name server knows the domain names and IP addresses of all top-level name servers.

[0036] A top-level domain name server (TLD) manages all second-level domains authorized by that TLD. The name of a TLD corresponds to the final suffix of a domain name, which is usually a name for an industry, such as .com, .net, .org, etc., or a name for a zone, such as .cn, .us, etc.

[0037] Authoritative name servers (DNS) are name servers responsible for a specific domain name zone. In other words, each level of a domain name zone is owned and managed by its corresponding authoritative name server. Authoritative name servers store the mappings from domain names to IP addresses for all hosts within that zone. For any host that owns a domain name, the mapping between its domain name and IP address is stored on the authoritative name server within its network. In other words, authoritative name servers directly provide the resolution results. For instance, when performing domain name resolution, as long as the authoritative name server corresponding to the queried domain name is found, the IP address information corresponding to that domain name can be obtained.

[0038] When performing domain name resolution, the domain name resolver will first search and respond to the domain name information cached locally. That is, if the domain name resolver has the information of the queried domain name stored in its memory, it will directly respond by sending the information of the queried domain name to the querying host. For example, Figure 1 As shown, when the client sends a query (11) to the domain name resolver to query the IP address of the domain name example.com, the domain name resolver first checks whether there is an IP address of the domain name example.com in the local cache. If there is an IP address of the domain name example.com in the local cache, the domain name resolver directly replies to the client (18). Otherwise, it needs to go through a recursive resolution process to obtain the IP address of the domain name example.com.

[0039] If the DNS resolver does not have the information of the queried domain in its cache, the DNS resolver will use a recursive resolution process to query other DNS servers for the information of the queried domain until a result is found, and finally send the query result to the query host.

[0040] The recursive DNS resolution process corresponds to a hierarchical domain name space, following a top-down hierarchical DNS resolution approach. For example, when a DNS resolver receives a query from a client, it initiates its own recursive resolution process, starting from the root name server based on the longest suffix matching principle and continuing until it reaches the authoritative name server for the domain name queried by the user. In other words, the authoritative server at the upper level replies with the location of the next-level name server, and the DNS resolver iteratively queries the new name servers, finally obtaining the authoritative response result, which includes information such as the IP address of the domain name queried by the user.

[0041] like Figure 1 As shown, the client sends a query request (11) to the domain name resolver to query the IP address of the domain name example.com. When the domain name resolver finds that there is no IP address of the domain name example.com in the local cache, the domain name resolver sends a query request (12) to the root domain name server. The root domain name server replies (13) with the reference information of the top-level domain name server that manages the ".com" domain name to the domain name resolver. The reference information of the top-level domain name server includes, for example, the IP address of the top-level domain name server.

[0042] After obtaining the IP address of the top-level domain name server, the domain name resolver sends another query request (14) to the top-level domain name server to query the IP address of the domain name example.com. The top-level domain name server replies (15) with the reference information of the second-level domain name server that manages the domain name example.com. The reference information of the second-level domain name server includes, for example, the IP address of the second-level domain name server.

[0043] Since this second-level domain name server is the authoritative domain name server managing the domain name example.com, when the domain name resolver sends another query request (16) to this authoritative domain name server to query the IP address of the domain name example.com, the authoritative domain name server can reply (17) with the IP address of the domain name example.com to the domain name resolver. The reply result of the authoritative domain name server is the final authoritative reply result. Therefore, the domain name resolver can finally reply (18) with the IP address of the domain name example.com obtained through recursive resolution query to the client.

[0044] During the above resolution process, the DNS resolver caches the authoritative response results and DNS server results obtained during the resolution process locally for subsequent use. Therefore, when the DNS resolver encounters a query for the same domain (e.g., example.com) again, it can first check if there is an authoritative response result for example.com in the cache. If the cache contains an authoritative response result for example.com, the recursive resolution process described above is unnecessary, allowing for a faster response to the client. Alternatively, the DNS resolver can first check if there is a result for the authoritative server managing the domain example.com in the cache. For example, if the cache contains the IP address of the authoritative server for example.com, the DNS resolver can directly query that authoritative server for the IP address of example.com. After receiving the DNS resolver's query request for example.com, the authoritative server replies with the IP address of example.com to the DNS resolver. This also eliminates the need for a top-down recursive resolution process from the root, effectively reducing query time and improving query efficiency.

[0045] Authoritative response results and DNS server results are stored in the cache for a limited time. The DNS resolver can only respond to the client with the locally cached result if a query is received within the cache's validity period. After the cache expires, the cached data is cleared, and to query the domain again, a recursive resolution process is required to iteratively query the DNS servers at each level. In some cases, users can obtain the domain's resource record through a query operation. This resource record contains relevant domain information and its cache validity period within a DNS resolver.

[0046] Figure 2 This is a schematic diagram of an exemplary resource record. For example, a resource record may include the domain's Time to Live (TTL), network / protocol type, resource record type, and resource record data. In embodiments of this disclosure, the domain's time to live can also be referred to as the cache validity period. The cache validity period refers to the maximum duration for which a resource record can be stored in the domain name resolver's cache; within the cache validity period, querying the domain name does not require recursive resolution queries. The network / protocol type refers to the protocols supported by the system, such as IN. Resource record types include address records (A records), domain name server records (NS records), mail records (MX records), canonical name records (CNAME records), and reverse lookup records (PTR records), etc. When a user queries a domain name, they can specify the type of resource record to query, for example, such as... Figure 2As shown, when a user queries the A record of the domain s.example.com, the DNS resolver returns the IP address of the domain s.example.com (e.g., 1.2.3.4). When a user queries the NS record of the domain s.example.com, the DNS resolver returns the domain name of the authoritative server of the domain s.example.com (e.g., ns.example.com). It should be noted that the NS record can only be set to a domain name, not an IP address.

[0047] If the DNS resolver caches authoritative response results and DNS server results for a domain name, then when a user queries a domain name and wants to view the resolution process, the DNS resolver can display the cached information related to that domain name to the user. This information includes the ANSWER section, the AUTHORITY section, and the ADDITIONAL section. The ANSWER section provides the answer to the user's query, i.e., the IP address corresponding to the queried domain name; the AUTHORITY section displays the DNS servers that directly provided the resolution results for this domain name, such as the NS record of the authoritative DNS server; the ADDITIONAL section displays the address of the DNS server that directly provided the domain name resolution results, such as the A record of the authoritative DNS server.

[0048] For example, such as Figure 2 As shown, when a user queries the A record of the domain s.example.com, the DNS resolver can output not only the Answer Statement (ANS), but also Authority Information (AUS) and Additional Information (ADS). For example, the ANS shows that the A record for the domain s.example.com is 1.2.3.4, and the cache expiration time for this resource record is 600 seconds. The AUS shows that the NS record for the domain example.com is ns.example.com, and the cache expiration time for this resource record is 302,400 seconds. The ADS shows that the A record for the domain ns.example.com is 1.1.1.1, and the cache expiration time for this resource record is 604,800 seconds.

[0049] For example, the domain name resolver caches domain name resource records including NS records and glue records. Glue records can be returned along with DNS query results, thus greatly reducing the number of recursive queries and speeding up DNS recursive queries.

[0050] For example, in one example, the NS record for the domain example.com is:

[0051] example.com NS ns.example.com

[0052] The Glue record for the domain example.com is:

[0053] ns.example.com A 1.1.1.1

[0054] Domain name servers (DNS) can be functionally divided into resolving DNS servers and authoritative DNS servers (DNS servers). Similar to hierarchical DNS resolution, domain name authorization is also hierarchical. Upper-level DNS servers control and allocate their own domains and all subdomains. That is, relying on the authoritative servers stored in the upper-level DNS zones, lower-level DNS zones can be defined, and upper-level DNS zones can authorize subdomains to lower-level DNS zones. This hierarchical domain name authorization mechanism provides the ability to allocate subdomains from top to bottom, allowing DNS servers at each level to authorize subdomains step by step, thus enabling convenient domain name management and efficient expansion. When a recursive DNS server queries an authoritative DNS server for a domain name, the authoritative DNS server will respond with the domain's complete IP address. If the authoritative DNS server does not store this IP address, it will point it to another authoritative DNS server.

[0055] Top-level domains (TLDs) require registration and filing before they can be used. After registration, the domain's NS (NS record) information is stored in the TLD server. Because registering and maintaining TLDs incurs significant costs, registered domains are prone to expiration or revocation. If a domain expires or is revoked, the TLD server will delete its NS record. Since the NS record no longer exists in the TLD zone file, no DNS resolver can resolve the domain through the normal recursive resolution process, resulting in the domain failing to resolve.

[0056] For example, such as Figure 3 As shown, when the registered domain example.com is revoked, the NS record for example.com at the top-level domain is deleted. Therefore, the top-level domain server will no longer be able to provide the NS record for example.com, and the domain name resolver cannot obtain the IP address of example.com through recursive resolution, resulting in the failure to resolve the domain name example.com. Similarly, when a registered domain is unexpectedly in other abnormal states, the domain may not be able to be resolved successfully, causing inconvenience to users and serious losses to the domain owner.

[0057] At least in part, this disclosure addresses the aforementioned problems by providing at least one embodiment of a domain name generation method. For example... Figure 4 As shown, the domain name generation method includes steps S110 to S140.

[0058] Step S110: Query the target domain name with one or more domain name resolvers, so that the domain name server record corresponding to the target domain name is cached in one or more domain name resolvers.

[0059] Step S120: Obtain the cache expiration time of the target domain name's domain name server record in one or more domain name resolvers.

[0060] Step S130: Authorize a new domain name and its domain name server resource record at the domain name server corresponding to the target domain name, based on the target domain name, wherein the new domain name is a subdomain of the target domain name.

[0061] Step S140: Before the cache expiration date, query one or more domain name resolvers for a new domain name generated based on the target domain name, so that one or more domain name resolvers cache the domain name server record of the new domain name.

[0062] According to at least one embodiment of the domain name generation method provided in this disclosure, the domain name owner can precisely control the timing of domain name queries and responses, and authorize subdomains and respond with new NS records to the target domain name resolver. Upon receiving the NS record of the subdomain, based on the domain name recursive resolution mechanism and the longest suffix matching principle for cache queries, the domain name resolver will determine the validity of the subdomain's NS record and store it in the cache for future queries. Due to the validity of the subdomain's NS record, all subsequent subdomain queries will be resolved successfully.

[0063] The domain name generation method provided in at least one embodiment of this disclosure can be executed iteratively and cyclically, generating multiple new domain names from a single domain name without the need to repeatedly register multiple domain names. It has the advantages of simple operation, low cost, and wide applicability. Furthermore, based on the domain name resolution mechanism and caching strategy, this domain name generation method can maintain the validity of continuously generated new domain names in the cache of the target domain name resolver to ensure the continuous survival of the domain names. This allows the target domain name resolver to continuously and successfully resolve the continuously generated new domain names, thereby greatly extending the survival time of expired or revoked domain names and ensuring the normal operation of domain name resolution.

[0064] For example, any user can use this domain name generation method to keep a domain name alive at the target domain name resolver. "Live" means the domain name can be successfully resolved, and the user can obtain the domain's resource record data, such as its IP address. The scope of "live" can be any network space, such as the Internet, a local area network (LAN), or an internal network like a corporate network. "Any user" includes the owner of a valid domain name, the owner of an expired domain name, or the original user of a domain name that has been revoked.

[0065] This domain name generation method can be used for various purposes, such as domain name commemoration, internal use, or disaster recovery backup. For example, when the upper-level domain name authority server unexpectedly fails, this domain name generation method can be used to ensure the normal operation of domain name resolution, thereby improving the reliability of domain name resolution.

[0066] This domain name generation method has a wide range of applications; any type of domain name can be used as the target domain name. For example, in at least one embodiment of this disclosure, the target domain name has a level of N, where N is a positive integer greater than 1 and less than 128. The target domain name can be any registered domain name, a subdomain of a registered domain name, or a subdomain of a multi-level domain name; the embodiments of this disclosure do not impose any restrictions on this.

[0067] For example, in one example, the target domain name has a level number of N=2, meaning it is a second-level domain. This target domain name can be a registered domain name, and it can be in a normal or abnormal state. A target domain name in a normal state can be successfully resolved by the DNS resolver, while a target domain name in an abnormal state cannot be successfully resolved by the DNS resolver. For example, in this example, a target domain name in an abnormal state could be an expired domain name, a faulty domain name, or a revoked domain name.

[0068] For example, in another example, the target domain has a level N = 3, meaning it is a third-level domain. The target domain can be a subdomain of a registered domain and can be in a normal or abnormal state. For instance, in this example, a target domain in an abnormal state could be a faulty domain or a revoked domain.

[0069] For example, in at least one embodiment of this disclosure, in step S110, a user can query one or more domain name resolvers for a target domain name to query resource record data of any type for the target domain name. After the query operation, the domain name server record (NS record) corresponding to the target domain name is cached in one or more domain name resolvers.

[0070] For example, the resource record type for querying the target domain name includes A record of IPv4 protocol, AAAA record of IPv6 protocol, NS record, MX record, CNAME record, PTR record or any other type. The embodiments of this disclosure do not limit this, and the specific meaning of these records can be referred to the corresponding protocols, which will not be repeated here. For ease of description, unless otherwise specified, the target domain name mentioned in step S110 below refers to the A record of the target domain name.

[0071] For example, a user can determine one or more domain name resolvers as target domain name resolvers based on their network location or actual needs, so that the domain name remains valid at the target domain name resolver required by the user. The target domain name resolver can be any domain name resolver, such as a domain name resolver set up by the user themselves, a domain name resolver for a company or enterprise, or a domain name resolver for an institution, etc., and the embodiments disclosed herein are not limited thereto.

[0072] For example, a user can choose one DNS resolver as the target DNS resolver, or they can choose any of multiple DNS resolvers on the Internet. It's important to note that if only one DNS resolver is selected as the target DNS resolver, the domain name generated using the domain name generation method can only be successfully resolved within that single DNS resolver. The domain name will not be resolved by other DNS resolvers. This is because only the cache of that single DNS resolver retains the relevant information for the domain name; other DNS resolvers do not. Therefore, only users using that single DNS resolver or the domain owner can obtain the DNS resolution results for that domain name. Users using other DNS resolvers cannot obtain the DNS resolution results for that domain name, and the domain owner cannot obtain the DNS resolution results for that domain name through other DNS resolvers.

[0073] It should be noted that step S110 occurs when the target domain name is in a normal, active state. That is, at this time, one or more domain name resolvers can query the domain name's resource record data from top to bottom through a normal recursive resolution process, and the target domain name can be successfully resolved. After the domain name resolver completes the recursive resolution, it stores the target domain name's DNS server record in its local cache for use in subsequent domain name queries.

[0074] In at least one embodiment of this disclosure, the target domain name can be any level of domain name from second-level domain to level 127 domain. As mentioned above, if the target domain name expires or is determined to be revoked, the domain name administrator managing the target domain name will remove the relevant information of the target domain name from the zone file. Thus, no domain name resolver can resolve the target domain name or any subdomain of the target domain name through the normal recursive resolution process because the NS record of the target domain name no longer exists in the zone file, and the recursive resolution process is interrupted. That is, the domain name resolver cannot know what the name server of the target domain name is, and therefore cannot query the name server of the target domain name for its A record. Similarly, the domain name resolver cannot know the name server of the subdomain of the target domain name through the recursive resolution process, and therefore cannot query the name server of the subdomain, let alone query the name server of the subdomain for its A record.

[0075] For example, in one instance, if the target domain is a second-level domain, then when the target domain expires or is revoked, the top-level name server that manages the NS records of the target domain will delete the NS records of the target domain.

[0076] For example, in another example, if the target domain is a third-level domain, then when the target domain expires or is revoked, the second-level domain name server that manages the NS records of the target domain will delete the NS records of the target domain.

[0077] However, for a DNS resolver that already has the target domain's NS record cached, that cached NS record remains valid. While this resolver cannot obtain the target domain's IP address through recursive resolution, it can directly query the target domain's authoritative name server (DNS) for the IP address. Furthermore, when the resolver receives a query request for a subdomain of the target domain, it can also use the longest suffix matching principle from the cached NS record to directly query the subdomain's authoritative name server to obtain the subdomain's IP address. In other words, as long as the resolver caches the parent domain's NS record, it doesn't need to query the subdomain's IP address through recursive resolution, because the parent domain's NS record contains the subdomain's authoritative name server. Once the resolver finds the subdomain's authoritative name server's IP address, it can directly query that server to obtain the subdomain's IP address.

[0078] It's important to note that while a DNS resolver that caches the NS record of the target domain can successfully resolve the target domain without relying on a recursive resolution process, this method has a time limit. That is, the DNS resolver can only continue to resolve the target domain within the cache's validity period. Once the cache expires and the NS record is cleared, the DNS resolver will no longer be able to resolve the target domain through the cache, nor will it be able to resolve the target domain through a recursive resolution process.

[0079] Therefore, after the DNS record corresponding to the target domain name is cached at the target domain name resolver, step S120 needs to be executed, that is, to obtain the cache validity period of the DNS record of the target domain name in one or more domain name resolvers, so as to accurately control the timing of authorizing the subdomain of the target domain name, that is, to "inject" the relevant information of the subdomain of the target domain name into the cache of the domain name resolver, and then to enable the authorized subdomain to be resolved successfully by authorizing the subdomain and setting a new cache validity period. Thus, the newly generated subdomain can remain valid at the target domain name resolver without relying on the recursive resolution process.

[0080] Since some domain name resolvers may not accept both A and NS results, the cache expiration period can be obtained by querying the domain name server records of the target domain. For example, in at least one example of the embodiments of this disclosure, step S120, which involves obtaining the cache expiration period of the domain name server records of the target domain in one or more domain name resolvers, may include: querying the domain name server records of the target domain from one or more domain name resolvers; and receiving a response from one or more domain name resolvers, the response including the cache expiration period of the domain name server records in one or more domain name resolvers.

[0081] It should be noted that once a domain name is cached, its cache validity period is determined and cannot be changed. Therefore, the domain name generation method disclosed herein injects a new cache validity period by generating and authorizing entirely new subdomains, thereby enabling the new subdomains to be cached in the domain name resolver and determined to be valid by the domain name resolver, thus achieving the effect of continuous domain name survival.

[0082] Then, in step S130, a new domain name and its associated DNS records are authorized at the DNS server corresponding to the target domain name, where the new domain name is a subdomain of the target domain name. For example, the domain owner can authorize a new subdomain at the authoritative server and simultaneously reply to the DNS resolver with the NS record of the new subdomain. For instance, in one example, the DNS server initially registered by the user is a second-level DNS server, and this DNS server is controlled by the user. That is, the authoritative server for the subdomain is controlled by the domain owner, so the authoritative server can reply with any content to the DNS resolver, such as the NS record of the subdomain and the cache expiration period of the NS record. For instance, in this example, the DNS servers for all subsequent subdomains can also be controlled by this same second-level DNS server, because the user can point all the DNS servers for these subdomains to the same IP address. Of course, the user can also set the DNS servers for newly generated subdomains to different DNS servers, such as other DNS servers purchased by the user.

[0083] For example, in at least one example of the embodiments of this disclosure, step S130, which is to authorize a new domain name and a domain name server resource record for the new domain name at the domain name server corresponding to the target domain name, may include: adding a prefix to the target domain name to generate a new domain name; setting an authorized resource record for the new domain name at the domain name server corresponding to the target domain name, wherein the authorized resource record includes a domain name server resource record and a glue resource record for the new domain name.

[0084] For example, the newly generated subdomain can be a target domain with a predefined prefix or a randomly generated prefix. The prefix format must be valid; otherwise, the embodiments of this disclosure do not impose restrictions on the type or number of characters of the prefix. For example, the prefix characters can be numbers or letters, and the prefix can have one or more characters, as long as it does not exceed the maximum length of the domain name. For example, in one example, if the target domain name is example.com, then the subdomain generated based on this target domain name could be s.example.com, or abc123.example.com, etc.

[0085] Since the total length of a domain name is limited (including the length of "."), to generate as many new subdomains as possible, the prefix of each subdomain can be set to one character each time the domain name generation method is executed iteratively. That is, each time a subdomain is generated, only a letter and a period are added to the beginning of the current domain name. This ensures the generation of new subdomains while reducing the domain name length, increasing the number of generated subdomains and thus further extending their lifespan. Simultaneously, the cache validity period of each subdomain's NS record in the domain name resolver can be set to the maximum value. For example, the cache validity period can be set to 7 days, and the prefix character count for each newly generated subdomain can be set to 1. Since the maximum subdomain length is 255, a maximum of 127 levels of subdomains can be generated. Because the cache validity period for each subdomain is 7 days, the combined cache validity periods of multiple subdomains can extend the lifespan of the last subdomain to more than two years, significantly improving the effectiveness of expired or faulty domains.

[0086] For example, when authorizing a subdomain, you need to specify the domain authorization resource record, which includes the subdomain's NS resource record and glue resource record.

[0087] For example, in one example, the target domain is example.com, and a new subdomain s.example.com is generated based on this target domain. The NS resource record for this subdomain is set as follows:

[0088] s.example.com NS ns.s.example.com

[0089] Glue resource records for this subdomain:

[0090] ns.s.example.com A 1.1.1.1

[0091] For example, in step S140, before the cache expiration date, one or more DNS resolvers are queried to generate a new domain name based on the target domain name, so that one or more DNS resolvers cache the DNS server record of the new domain name. When an NS record for a subdomain is received, the DNS resolver stores it in its cache and determines it to be valid. In this way, the domain owner can continuously authorize subdomains of the subdomain and reply with NS records. The newly generated subdomains are determined to be valid in the DNS resolvers and have a new cache expiration date, so the new domain name can continue to exist.

[0092] For example, in the example above, the target DNS resolver is queried for the newly generated subdomain s.example.com, so that the target DNS resolver caches the NS record for the new domain: s.example.com NS ns.s.example.com. The target DNS resolver can also cache the A record (glue record) for the new domain's DNS server: ns.s.example.com A 1.1.1.1. The NS and Glue records can remain in the target DNS resolver for the duration of their cached validity.

[0093] Figure 5 This is a flowchart illustrating an exemplary domain name generation method provided for at least one embodiment of this disclosure. The following is in conjunction with... Figure 5 The following briefly describes the iterative process of the domain name generation method provided in at least one embodiment of this disclosure. This domain name generation method can iteratively generate multi-level subdomains, which can improve the reliability of domain name resolution during disaster recovery backup.

[0094] First, in the first loop, in step S210, the cache validity period of the NS record of the target domain name in the domain name resolver is obtained. For example, the cache validity period of the target domain name example.com in the domain name resolver is TTL1.

[0095] Then, in step S220, a subdomain of the target domain is generated. For example, adding an "s" prefix to the target domain example.com results in the subdomain s.example.com.

[0096] Next, in step S230, before the cache expiration of the target domain's NS record in the domain name resolver expires, the subdomain's authorized resource record is injected into the domain name resolver. For example, before TTL1 becomes 0, the authorized resource record of the subdomain s.example.com is queried from the domain name resolver to cache the NS and Glue records of the subdomain s.example.com in the domain name resolver. The new cache expiration time TTL2 of the injected subdomain can be customized, so that the subdomain s.example.com can be successfully resolved. That is, the subdomain's lifespan is TTL2.

[0097] Then, in step S240, it is determined whether the subdomain has reached the maximum level. If the subdomain has not reached the maximum level, the subdomain can be used as a new target domain, and steps S210 to S240 are repeated; if the subdomain has reached the maximum level and no more subdomains of the subdomain can be generated, the loop ends. The embodiments of this disclosure do not limit the judgment conditions of step S240.

[0098] In summary, by precisely controlling the cache expiration period of a domain name and promptly querying the target domain name within that period, the NS records of the subdomain can be continuously cached. Based on the longest suffix matching principle, even if the target domain name expires or is revoked, the target domain name resolver can still successfully resolve it.

[0099] Figure 3 This is a schematic diagram illustrating the process of maintaining a domain name's continuous existence, provided in at least one embodiment of this disclosure. Figure 3 As shown, after the target domain example.com is revoked, the NS record of the target domain example.com is deleted in the top-level domain, and the domain name resolver cannot resolve the target domain or its existing subdomains through the recursive resolution process. However, through the domain name generation method provided in at least one embodiment of this disclosure, for example, in the first loop, the domain name owner can query the domain name resolver for (21) the A record of the new subdomain s.example.com of the target domain before the cache validity period TTL1 (e.g., 86400 seconds) of the target domain expires. Since the domain name resolver caches the NS record of the target domain example.com, the domain name resolver can directly query the authoritative domain name server 1 for (22) the A record of the subdomain s.example.com.

[0100] After receiving the query from the domain name resolver, the domain owner authorizes the new subdomain s.example.com at authoritative name server 1 and replies to the domain name resolver with (23) the address of the authoritative name server for the subdomain s.example.com. For example, reply (23) would be:

[0101] s.example.com NS 604800ns.s.example.com

[0102] ns.s.example.com A 604800 1.2.3.4

[0103] After the DNS resolver obtains the NS record of the subdomain s.example.com, it caches the NS record of the subdomain s.example.com locally. The cache validity period is the new cache validity period TTL2 set by the domain owner when authorizing the subdomain: 604800 seconds.

[0104] Similarly, in the second loop, the domain owner can query the domain name resolver again (21) for the A record of the new subdomain ssexample.com of the target domain s.example.com before the TTL2 validity period of the domain name resolver expires. Since the domain name resolver has cached the NS record of s.example.com, the domain name resolver can directly query the authoritative domain name server 2 (24) for the A record of the new subdomain ssexample.com.

[0105] After receiving the query from the domain name resolver, the domain owner authorizes the new subdomain ssexample.com at authoritative name server 2 and replies to the domain name resolver with (25) the address of the authoritative name server for the subdomain ssexample.com. For example, reply (25) would be:

[0106] ssexample.com NS 604800ns.ssexample.com

[0107] ns.ssexample.com A 604800 1.2.3.4

[0108] After the DNS resolver obtains the NS record of the subdomain ssexample.com, it caches the NS record of the subdomain ssexample.com locally. The cache validity period is the new cache validity period TTL3 set by the domain owner when authorizing the subdomain: 604800 seconds.

[0109] It should be noted that the domain name generation method provided in the embodiments of this disclosure is not affected by "domain name expiration", "domain name revocation", "domain name failure", sudden failure of the domain name server or other unexpected events. In other words, the cyclical process of the domain name generation method will not be interrupted by the occurrence of these events. For example, if the registered domain name used as the target domain name is a normal domain name in the first cycle, and the registered domain name expires or is revoked in the nth cycle, the (n+1)th cycle can still continue to generate a new subdomain name, and the user can continue to access the website through the subdomain name cached by the domain name resolver.

[0110] The domain name generation method provided in at least one embodiment of this disclosure targets a domain name resolver and uses the domain name system's own resolution mechanism and caching strategy to generate a new set of domain names (a set of all newly generated subdomains) for a single domain name. Since it does not require repeated registration of different domain names, it solves the drawback of traditional domain name generation algorithms that require repeated registration of different domain names, and can enable a single domain name to continue to exist after it expires or is revoked.

[0111] To prevent the domain name generation method provided in at least one embodiment of this disclosure from being abused (e.g., it may be used to generate malicious domain names), at least one embodiment of this disclosure also provides a corresponding domain name detection method, which can detect malicious domain names generated by the domain name generation method.

[0112] like Figure 6 As shown, the domain name detection method includes the following steps S310 to S330.

[0113] Step S310: Check if there is a domain name server resource record for the target domain name to be detected in the cache of the domain name resolver.

[0114] Step S320: In response to the existence of a domain name server resource record for the target domain name to be detected in the cache of the domain name resolver, check whether there are domain name server resource records for the parent domain to the M-th level parent domain of the target domain name to be detected in the cache of the domain name resolver, where M is a positive integer greater than or equal to 1 and less than 128.

[0115] Step S330: Output the detection results for the target domain name to be detected.

[0116] For example, the owner of a domain name resolver can use this domain name detection method to check whether there are malicious domain name server resource records in the domain name resolver's cache, thereby monitoring and preventing attacks by malicious domain names in a timely manner.

[0117] For example, any domain name can be retrieved from the DNS resolver's cache as the target domain name to be checked, or all domain names in the DNS resolver's cache can be traversed and checked.

[0118] For example, you can first check if there is a resource record for the target domain name to be detected in the cache of the domain name resolver. If there is a resource record for the target domain name to be detected, you can further execute step S310 to check if the resource record type of the target domain name to be detected is of type NS. If there is no type NS, it means that the target domain name to be detected is not a malicious domain name generated by the domain name generation method provided in this embodiment of the disclosure.

[0119] For example, it is then necessary to check whether there are NS resource records for all levels of domains above the target domain to be detected in the cache, such as the parent domain of the target domain to be detected, the parent domain of the parent domain, etc. For example, in step S320, if the check finds that there is a domain name server resource record (NS record) for the target domain to be detected in the cache of the domain name resolver, then it further checks whether there is an NS resource record for the parent domain of the target domain to be detected in the cache of the domain name resolver. If the domain name resolver caches an NS resource record for the parent domain, it continues to check the NS resource record for the parent domain of the parent domain, until it checks upward to the M-th level parent domain, where M is a positive integer greater than or equal to 1 and less than 128. For example, M can be the domain level after checking upward a fixed number of levels as defined by the detector, or it can be the domain level of the recursive interruption level found by recursive resolution query. The embodiments of this disclosure do not limit the method of determining the M-th level parent domain.

[0120] For example, in one example, the target domain to be detected is a second-level domain, and the M-level parent domain can be the parent domain of the second-level domain or the parent domain of the parent domain, such as the top-level domain or the root domain.

[0121] For example, in another example, the target domain name to be detected is a fourth-level domain name, and the M-level parent domain name can be an expired or revoked second-level domain name.

[0122] For example, regulators outside of domain name resolvers can also use this domain name detection method to check whether there are malicious domain name server resource records in the cache of open domain name resolvers on the Internet, thereby monitoring and preventing attacks by malicious domain names in a timely manner.

[0123] For example, the regulator can proactively query a designated domain name resolver to check if the resolver's cache contains any NS type resource records for the target domain name to be detected. If no NS type records are found, it indicates that the target domain name to be detected is not a malicious domain name generated using the domain name generation method provided in this disclosure. If NS type resource records are found, the regulator can continue to query the NS resource records of the target domain name's multi-level parent domains according to the aforementioned domain name detection method.

[0124] To reduce monitoring costs, at least one embodiment of this disclosure also provides a detection method that can predict whether a domain name to be detected is a malicious domain name generated by the domain name generation method of this disclosure.

[0125] Figure 7 This is a schematic diagram of a method for predicting malicious domain names in a domain name detection method provided in at least one embodiment of the present disclosure.

[0126] For example, at least one embodiment of the domain name detection method provided in this disclosure further includes the following steps S410 to S430.

[0127] Step S410: Obtain the domain name to be tested.

[0128] Step S420: Determine whether the domain to be tested needs to be identified as the target domain to be tested based on the level of the domain to be tested.

[0129] Step S430: If the number of levels of the domain name to be detected exceeds the threshold number of levels, then the domain name to be detected is determined as the target domain name to be detected.

[0130] The number of threshold levels can be set by the detection party according to actual needs, such as 5 levels, 6 levels, 8 levels or more.

[0131] For example, the domain name to be tested can be obtained by randomly sampling any domain name on the network, or by randomly sampling or traversing the domain names cached in a specified domain name resolver.

[0132] To ensure subdomains survive for as long as possible, the domain name generation method provided in this disclosure typically generates domains with more levels. Therefore, this characteristic can be used to predict the domain name to be detected. For example, a typical domain name has fewer than 10 levels. If the domain name to be detected is found to have more than 10 levels, it is highly likely to be a malicious domain. Therefore, once the domain name to be detected is found to have a level significantly greater than the level required for normal use, it can be identified as a target domain name to be detected, and this domain name can be subjected to focused detection through steps S310 to S330.

[0133] For example, for network regulators, they can also focus on monitoring domains with a domain number of 10 or more, thereby improving monitoring efficiency and reducing monitoring costs.

[0134] Figure 8 This is a schematic diagram illustrating the method for handling malicious domain names in a domain name detection method provided in at least one embodiment of this disclosure.

[0135] For example, at least one embodiment of the domain name detection method provided in this disclosure further includes steps S510 to S530.

[0136] Step S510: Determine the processing method for the target domain name based on the detection results.

[0137] Step S520: If the detection result of the target domain name to be detected shows that there are domain name server resource records from the parent domain name to the M-level parent domain name of the target domain name to be detected in the cache of the domain name resolver, then issue a warning or check whether the target domain name to be detected is a malicious domain name.

[0138] Step S530: In response to the fact that the target domain name to be detected is a malicious domain name, delete the content related to the target domain name to be detected from the cache of the domain name resolver, or add the target domain name to the domain name blacklist for the network operator to handle.

[0139] For example, in step S510, the processing method for the target domain name to be detected is determined based on the detection result of the target domain name to be detected. If the detection result of the target domain name to be detected shows that there is no NS resource record of the target domain name to be detected in the cache of the domain name resolver, or although there is an NS resource record of the target domain name to be detected, there is no NS resource record of its parent domain, then the detection ends; otherwise, step S520 is executed.

[0140] For example, in step S520, if the regulator finds that the detection results of the target domain name show that the DNS resolver's cache contains DNS server resource records from the target domain name's parent domain to the M-level parent domain, it can issue a warning to the DNS resolver owner or network operator to notify them that the target domain name may be malicious. Alternatively, if the regulator finds that the detection results of the target domain name show that the DNS resolver's cache contains DNS server resource records from the target domain name's parent domain to the M-level parent domain, the DNS resolver owner or network operator can continue to detect the target domain name, for example, by manually detecting it or using other detection methods to determine whether the target domain name is malicious.

[0141] For example, in step S530, if the regulator determines that the target domain name to be detected is a malicious domain name, it can require the domain name resolver to delete all content related to the target domain name in the cache, such as NS resource records, A records, etc. Alternatively, the regulator can add the malicious domain name to a domain name blacklist so that various network operators can identify or filter the malicious domain name.

[0142] For example, in step S530, if the domain name resolver determines that the target domain name to be detected is a malicious domain name, it can directly delete all resource records related to the malicious domain name in the cache. For example, it can also delete resource records of other domain names at all levels corresponding to the malicious domain name, thereby preventing attacks from the malicious domain name and its related domain names.

[0143] At least one embodiment of this disclosure also provides an electronic device. Figure 9 This is a schematic block diagram of an electronic device provided for at least one embodiment of the present disclosure.

[0144] For example, such as Figure 9 As shown, the electronic device includes a processor 1001, a communication interface 1002, a memory 1003, and a communication bus 1004. The processor 1001, communication interface 1002, and memory 1003 communicate with each other through the communication bus 1004, and the components such as the processor 1001, communication interface 1002, and memory 1003 can also communicate with each other through network connection.

[0145] For example, memory 1003 is used to store computer-executable instructions non-transitory. When processor 1001 runs the computer-executable instructions, the computer-executable instructions are executed by processor 1001 to implement the domain name generation method or domain name detection method according to any of the above embodiments. For specific implementation details and related explanations of each step of the domain name generation method or domain name detection method, please refer to the above text, and will not be repeated here.

[0146] For example, processor 1001 can control other components in an electronic device to perform desired functions. Processor 1001 can be a central processing unit (CPU), a network processor (NP), or a digital signal processor (DSP), application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The central processing unit (CPU) can be an x86 or ARM architecture, etc. For example, processor 1001 executes the program stored in memory 1003 to implement the domain name generation method or domain name detection method, which is the same as in the embodiments described above and will not be repeated here.

[0147] For example, the communication bus 1004 can be a Peripheral Component Interconnect Standard (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. This communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but this does not indicate that there is only one bus or one type of bus. For example, the communication interface 1002 is used to realize communication between electronic devices and other devices.

[0148] For example, memory 1003 may include any combination of one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. Volatile memory may include, for example, random access memory (RAM) and / or cache memory. Non-volatile memory may include, for example, read-only memory (ROM), hard disk, erasable programmable read-only memory (EPROM), portable compact disc read-only memory (CD-ROM), USB memory, flash memory, etc. One or more computer-executable instructions may be stored on the computer-readable storage medium, and processor 1001 may execute the computer-executable instructions to implement various functions of the electronic device. Various application programs and various data may also be stored in the storage medium. For a detailed description of the process by which the electronic device executes the domain name generation method or domain name detection method, please refer to the relevant descriptions in the embodiments of the domain name generation method or domain name detection method above; repeated descriptions will not be repeated here.

[0149] Figure 10 This is a schematic diagram of a non-transitory computer-readable storage medium provided for at least one embodiment of the present disclosure. For example, such as Figure 10 As shown, one or more computer-executable instructions 1101 may be stored non-temporarily on storage medium 1100. For example, when the computer-executable instructions 1101 are executed by a processor, one or more steps in the domain name generation method or domain name detection method described above may be performed.

[0150] For example, the storage medium 1100 can be used in the aforementioned electronic device 800. For example, the storage medium 1100 may include the memory 1003 in the electronic device. A description of the storage medium 1100 can be found in the description of the memory 1003 in the embodiments of the electronic device; details will not be repeated here.

[0151] Although the present disclosure has been described in detail above with general descriptions and specific embodiments, modifications or improvements can be made to the embodiments of the present disclosure, which will be obvious to those skilled in the art. Therefore, all such modifications or improvements made without departing from the spirit of the present disclosure are within the scope of protection claimed by the present disclosure.

[0152] The following points should be noted regarding this disclosure:

[0153] (1) The accompanying drawings of the embodiments of this disclosure only involve the structures involved in the embodiments of this disclosure. Other structures can be referred to the general design.

[0154] (2) For clarity, the thickness of layers or regions in the drawings used to describe embodiments of the present disclosure is enlarged or reduced, i.e., these drawings are not drawn to actual scale.

[0155] (3) Where there is no conflict, the embodiments of this disclosure and the features in the embodiments can be combined with each other to obtain new embodiments.

[0156] The above description is merely a specific embodiment of this disclosure, but the scope of protection of this disclosure is not limited thereto. The scope of protection of this disclosure should be determined by the scope of protection of the claims.

Claims

1. A method for generating a domain name, comprising: Query the target domain name with one or more domain name resolvers, so that the domain name server record corresponding to the target domain name is cached in the one or more domain name resolvers; Obtain the cache expiration time of the domain name server record of the target domain name in the one or more domain name resolvers; Based on the target domain name, a new domain name is authorized at the domain name server corresponding to the target domain name, as well as the domain name server resource record of the new domain name, wherein the new domain name is a subdomain of the target domain name; Before the cache expiration date, the system queries one or more domain name resolvers for the new domain name generated based on the target domain name, so that the one or more domain name resolvers cache the domain name server record of the new domain name. In response to the new domain name not reaching the maximum level, the new domain name is used as the new target domain name, and the domain name generation method is executed repeatedly.

2. The domain name generation method according to claim 1, wherein, The target domain name has a level of N, where N is a positive integer greater than 1 and less than 128.

3. The domain name generation method according to claim 1, wherein, The target domain name includes registered domain name, normal domain name, expired domain name, faulty domain name, or revoked domain name.

4. The domain name generation method according to any one of claims 1-3, wherein, The cache expiration period of the domain name server record for obtaining the target domain name in the one or more domain name resolvers includes: Query the domain name server records of the target domain name from the one or more domain name resolvers; Receive a response from one or more domain name resolvers, the response including the cache expiration date recorded by the domain name server in the one or more domain name resolvers.

5. The domain name generation method according to any one of claims 1-3, wherein, The authorization of a new domain name at the domain name server corresponding to the target domain name based on the target domain name and the domain name server resource record of the new domain name include: Add a prefix to the target domain name to generate the new domain name; Set the authorized resource record for the new domain name at the domain name server corresponding to the target domain name, wherein the authorized resource record includes the domain name server resource record and glue resource record of the new domain name.

6. A domain name detection method, comprising: Check if the DNS resolver's cache contains a DNS server resource record for the target domain name to be tested; In response to the existence of a domain name server resource record for the target domain name to be detected in the cache of the domain name resolver, it is checked whether there are domain name server resource records from the parent domain to the M-th level parent domain of the target domain name to be detected in the cache of the domain name resolver, where M is a positive integer greater than or equal to 1 and less than 128; Output the detection results for the target domain name to be detected.

7. The domain name detection method according to claim 6 further includes: Obtain the domain name to be tested; Determine whether the domain name to be detected needs to be identified as the target domain name based on the level of the domain name to be detected; If the number of levels of the domain name to be detected exceeds the threshold number of levels, then the domain name to be detected is determined as the target domain name to be detected.

8. The domain name detection method according to claim 6 or 7 further includes: The processing method for the target domain name to be detected is determined based on the detection result. If the detection result of the target domain name to be detected shows that the domain name resolver cache contains domain name server resource records from the parent domain name of the target domain name to the M-level parent domain name, then a warning is issued or the target domain name to be detected is checked to see if it is a malicious domain name; In response to the fact that the target domain name to be detected is a malicious domain name, the content related to the target domain name to be detected in the cache of the domain name resolver is deleted, or the target domain name to be detected is added to the domain name blacklist for network operators to handle.

9. An electronic device, comprising: Memory stores computer-executable instructions non-transiently; The processor is configured to run computer-executable instructions. The computer-executable instructions are executed by the processor to implement the domain name generation method as described in any one of claims 1-5 or the domain name detection method as described in any one of claims 6-8.

10. A non-transitory computer-readable storage medium, wherein, The non-transitory computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, implement the domain name generation method as described in any one of claims 1-5 or the domain name detection method as described in any one of claims 6-8.

Images