Method and device for identifying domain name without actual service, electronic equipment and readable storage medium

Abstract

The application provides a method and device for identifying a domain name without actual domain name, an electronic device and a readable storage medium. The IP address corresponding to the domain name to be identified is obtained. If the number of corresponding IP addresses is equal to 1, the subdomain part string of the domain name to be identified is extracted. The IP address is segmented to obtain IP segmentation information, and the subdomain part string is segmented to obtain subdomain segmentation information. Whether the domain name to be identified is a domain name without actual business is determined by comparing the IP segmentation information and the subdomain segmentation information. The relationship between the subdomain part and the IP address in the domain name without actual business is analyzed, so that whether the domain name to be identified is a domain name without actual business can be accurately determined based on the subdomain part and the IP address in the domain name to be identified, thereby improving the work efficiency of automatic tool detection and manual penetration testing.

Description

Technical Field

[0001] This invention relates to the field of domain name resolution technology, and more specifically, to a method, apparatus, electronic device, and readable storage medium for identifying domain names without actual business operations. Background Technology

[0002] In the cybersecurity industry, when conducting security assessments and penetration tests on an organization's IT system, the main domain of the organization is expanded to include subdomains to obtain a list of as many subdomains as possible. Then, the website systems corresponding to these subdomains are used to conduct security assessments and penetration tests through automated tools and manual penetration testing.

[0003] In this scenario, "domains without actual business operations" do not carry any real business or provide IT services, and therefore do not require subsequent tool testing or manual penetration testing. If the expanded subdomain list contains many domains without actual business operations, it will affect the efficiency of subsequent work.

[0004] If the total number of domains is small, domains without actual business operations can be manually removed before proceeding with subsequent work. However, if the number of domains is large, manual inspection is too inefficient. Therefore, there is an urgent need for a method to automatically identify domains without actual business operations. This would allow for the removal of domains without actual business operations from the large number of domains, retaining only those that carry actual business operations for further automated tool detection and manual penetration testing, thereby improving overall work efficiency. Summary of the Invention

[0005] The objectives of this invention include, for example, providing a method, apparatus, electronic device, and readable storage medium for identifying domain names without actual business operations, which can accurately identify domain names without actual business operations, thereby improving the efficiency of automated tool detection and manual penetration testing.

[0006] The embodiments of the present invention can be implemented as follows: In a first aspect, the present invention provides a method for identifying domain names without actual business operations, the method comprising: Obtain the IP address corresponding to the domain name to be identified; If the number of IP addresses corresponding to the domain name to be identified is equal to 1, extract the subdomain part string of the domain name to be identified; The IP address is segmented to obtain IP segmentation information, and the subdomain part of the string is segmented to obtain subdomain segmentation information; The IP segmentation information and subdomain segmentation information are compared to determine whether the domain name to be identified is a domain name without actual business.

[0007] In an optional implementation, the step of segmenting the subdomain portion of the string to obtain subdomain segmentation information includes: The subfield portion string is divided into multiple character groups based on the delimiter in the subfield portion string; The multiple character groups are filtered out to obtain subdomain segmentation information composed of multiple character groups after filtering.

[0008] In an optional implementation, the step of filtering out the plurality of character groups includes: Delete the non-numeric characters in the multiple character groups; Remove the leading zero from the character set containing the leading zero; Delete the character group containing the empty element.

[0009] In an optional implementation, the IP segmentation information consists of multiple IP groups; The step of comparing the IP segmentation information and the subdomain segmentation information to determine whether the domain name to be identified is a domain name without actual business operations includes: If there is no character group in the plurality of character groups that matches the last IP group in the plurality of IP groups, or if there is no character group that matches the last IP group and the second to last IP group in the plurality of IP groups respectively, then the domain name to be identified is determined to be a domain name without actual business. If there are character groups among the plurality of character groups that are consistent with the last and second-to-last IP groups among the plurality of IP groups, then the domain name to be identified is determined to be a domain name without actual business based on the character groups that are consistent with the last and second-to-last IP groups among the plurality of IP groups.

[0010] In an optional implementation, the step of determining whether the domain name to be identified is a domain name without actual business operations based on the character groups that match the penultimate IP group and the penultimate IP group, respectively, among the plurality of IP groups, includes: Determine the first position of the character group that matches the last IP group in the plurality of character groups, and the second position of the character group that matches the second-to-last IP group in the plurality of character groups; Based on the first and second positions, it is determined whether the domain name to be identified is a domain name without actual business.

[0011] In an optional implementation, the step of determining whether the domain name to be identified is a domain name without actual business operations based on the first position and the second position includes: When the absolute value of the difference between the first position and the second position is 1, the domain name to be identified is determined to be a domain name without actual business. If the absolute value of the difference between the first position and the second position is not 1, the domain name to be identified is determined to be a domain name without actual business.

[0012] In an optional implementation, the method further includes: If the number of IP addresses corresponding to the domain name to be identified is greater than 1, it is determined that the domain name to be identified is not a domain name without actual business.

[0013] Secondly, the present invention provides a domain name identification device without actual business operations, the device comprising: The acquisition module is used to obtain the IP address corresponding to the domain name to be identified; The extraction module is used to extract the subdomain portion string of the domain name to be identified when the number of IP addresses corresponding to the domain name to be identified is equal to 1. The segmentation module is used to segment the IP address to obtain IP segmentation information and to segment the subdomain part string to obtain subdomain segmentation information; The judgment module is used to compare the IP segmentation information and the subdomain segmentation information to determine whether the domain name to be identified is a domain name without actual business.

[0014] Thirdly, the present invention provides an electronic device including one or more storage media and one or more processors communicating with the storage media. The one or more storage media store machine-executable instructions that can be executed by the processor. When the electronic device is running, the processor executes the machine-executable instructions to perform the steps of the method described in any of the foregoing embodiments.

[0015] Fourthly, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in any of the foregoing embodiments.

[0016] The beneficial effects of the embodiments of the present invention include, for example: This application provides a method, apparatus, electronic device, and readable storage medium for identifying domains without actual business operations. The method involves obtaining the IP address corresponding to the domain name to be identified. If the number of corresponding IP addresses is equal to one, the subdomain portion of the domain name is extracted. The IP address is then segmented to obtain IP segmentation information, and the subdomain portion is segmented to obtain subdomain segmentation information. By comparing the IP segmentation information and the subdomain segmentation information, it is determined whether the domain name to be identified is a domain without actual business operations. This solution analyzes the inherent relationship between the subdomain portion and the IP address in a domain name without actual business operations, thereby accurately determining whether a domain name to be identified is a domain without actual business operations based on the subdomain portion and the IP address, thus improving the efficiency of automated tool detection and manual penetration testing. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 A flowchart illustrating the method for identifying domain names without actual business operations provided in this application embodiment; Figure 2 for Figure 1 A flowchart of the sub-steps included in step S13; Figure 3 for Figure 1 A flowchart of the sub-steps included in step S14; Figure 4 A flowchart illustrating the overall process of identifying domain names without actual business operations provided in this application embodiment; Figure 5 A structural block diagram of the electronic device provided in the embodiments of this application; Figure 6 This is a functional block diagram of a domain name identification device without actual business provided in an embodiment of this application.

[0019] Icons: 110-Processor; 120-Memory; 130-Communication module; 140-Domain-less domain name identification device; 141-Acquisition module; 142-Extraction module; 143-Segmentation module; 144-Judgment module. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0021] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0022] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0023] In the description of this invention, it should be noted that the terms "first" and "second" are used only for distinguishing descriptions and should not be construed as indicating or implying relative importance.

[0024] It should be noted that, where there is no conflict, the features in the embodiments of the present invention can be combined with each other.

[0025] A domain name is a string of names separated by dots on the Internet that identifies a computer or group of computers and is used to locate the computer during data transmission.

[0026] A domain name can be considered a substitute for an IP address, designed for ease of memorization. For example, baidu.com is a domain name. People can directly access baidu.com instead of using an IP address, and the Domain Name System (DNS) will then translate it into an IP address that is easily recognized by machines. In this way, people only need to remember the string of characters with special meaning, baidu.com, instead of memorizing meaningless numbers.

[0027] A top-level domain (TLD) is the highest-level domain in the Internet DNS hierarchy, and it is stored in the namespace of the DNS root domain. The TLD is the last part of a domain name, that is, the letters after the last dot. For example, in the domain example.com, the TLD is .com.

[0028] A second-level domain (SLD) is a domain in the Internet DNS hierarchy that lies below the top-level domain (TLD). A SLD is the second-to-last part of a domain name; for example, in the domain example.com, the SLD is "example".

[0029] A subdomain is a domain that belongs to a higher level in the Domain Name System (DNS). For example, mail.example.com and calendar.example.com are two subdomains of example.com, which in turn is a subdomain of the top-level domain .com.

[0030] An A (Address) record is used to specify the IP address corresponding to a domain name. An A record can correspond to 0, 1, or multiple IP addresses.

[0031] The following example demonstrates how to use Python code to retrieve the A records for the domains "www.example.com" and "sip.example.com".

[0032] in: The A record for the domain name "www.example.com" contains one IP address; The A record for the domain name "sip.example.com" contains two IP addresses.

[0033] >>>import dns.resolver >>>answer = dns.resolver.query("www. example.com", "A") >>>list(map(lambda x: x.to_text(), answer)) ['1.2.3.4] >>>answer = dns.resolver.query("sip.example.com", "A") >>>list(map(lambda x: x.to_text(), answer)) ['1.2.3.4', '1.2.3.5'] Ordinary subdomains carry specific business functions. For example, www.example.com typically carries the business functions of an official website; mail.example.com typically carries email services; and blog.example.com typically carries blog services.

[0034] Some subdomains do not carry any actual business operations and are called "domains without actual business operations". For example: The A record IP address for the domain 1-2-3-4.example.com is 1.2.3.4. The A record IP address for the domain 1-2-3-5.example.com is 1.2.3.5. The A record IP address for the domain 1-2-3-6.example.com is 1.2.3.6. The A record IP address for the domain 1-2-3-7.example.com is 1.2.3.7. The A record IP address for the domain 1-2-3-8.example.com is 1.2.3.8. The A record IP address for the domain host123.111.example.com is 111.111.111.123. The A record IP address for the domain host124.111.example.com is 111.111.111.124. The A record IP address for the domain host125.111.example.com is 111.111.111.125. These domain names, which have no actual business purpose, are mostly used for reverse DNS lookup, serving as a mapping from IP addresses to DNS names. As shown in the example above, their characteristic is that the string content in the subdomain corresponds to the IP address of the domain's A record.

[0035] In the cybersecurity industry, when conducting security assessments and penetration tests on an organization's IT systems, the main domain is often expanded to include subdomains to obtain a list of as many subdomains as possible. Many of these subdomains are domains without any actual business operations. Since these domains do not support actual business activities or provide IT services, they do not require further tool testing or manual penetration testing. If the expanded subdomain list includes a large number of these domains, it will impact the efficiency of subsequent work. Therefore, an accurate and efficient method is needed to identify these domains to improve work efficiency.

[0036] Based on the above research, this application provides a method for identifying domain names without actual business operations. By analyzing the inherent relationship between the subdomain portion and the IP address in a domain name without actual business operations, it can accurately and efficiently determine whether a domain name to be identified is a domain name without actual business operations based on the subdomain portion and the IP address, thereby improving the efficiency of automated tool detection and manual penetration testing.

[0037] Figure 1 shows a flowchart of the method for identifying domain names without actual business operations provided in an embodiment of this application. This method can be executed by a device for identifying domain names without actual business operations. This device can be implemented by software and / or hardware and can be configured in an electronic device, which can be a computer device. The detailed steps of this method are described below.

[0038] S11, obtain the IP address corresponding to the domain name to be identified.

[0039] S12, if the number of IP addresses corresponding to the domain name to be identified is equal to 1, extract the subdomain part string of the domain name to be identified.

[0040] S13, the IP address is segmented to obtain IP segmentation information, and the subdomain part string is segmented to obtain subdomain segmentation information.

[0041] S14. Compare the IP segmentation information and subdomain segmentation information to determine whether the domain name to be identified is a domain name without actual business.

[0042] In this embodiment, the IP address corresponding to the domain name to be identified is obtained. Taking Python script as an example, the IP address of the A record of the domain name to be identified can be obtained in the following way: >>>import dns.resolve >>>answer = dns.resolver.query("1-2-3-4.example.com ", "A") >>>list(map(lambda x: x.to_text(), answer)) ['1.2.3.4'] >>>answer = dns.resolver.query("bus.sina.com.cn", "A") >>>list(map(lambda x: x.to_text(), answer)) ['1.2.3.4', '1.2.3.5'] The A record IP address for the domain name "1-2-3-4.example.com" is ['1.2.3.4'], and the number of such IP addresses is 1.

[0043] The A record IP address for the domain name "www.example.com" is ['1.2.3.4', '1.2.3.5'], which corresponds to 2 IP addresses, not 1.

[0044] Research on the number of IP addresses in A records for domains without actual business operations revealed that the number of IP addresses in A records for domains without actual business operations is 1. Therefore, in this embodiment, if the number of IP addresses corresponding to the domain to be identified is greater than 1, it can be determined that the domain to be identified is not a domain without actual business operations. However, if the number of IP addresses corresponding to the domain to be identified is equal to 1, further judgment based on the relationship between the subdomain portion of the domain to be identified and the IP addresses is required.

[0045] In this embodiment, the subdomain part string of the domain name to be identified is extracted. For example, for the domain name "1-2-3-4.example.com", the extracted subdomain part string is "1-2-3-4", and for the domain name "mail.example.com", the extracted subdomain part string is "mail", or for the domain name "host123.111.example.com", the extracted subdomain part string is "host123.111".

[0046] For the IP address and subdomain portion of the domain name to be identified obtained through the above methods, the IP address can be segmented to obtain IP segmentation information, and the subdomain portion of the string can be segmented to obtain subdomain segmentation information.

[0047] Research and analysis revealed a direct correspondence between the subdomain portion of a domain name without actual business operations and its A record IP address. For example, the subdomain portion of the domain name "1-2-3-4.example.com" is "1-2-3-4", which corresponds perfectly to its A record IP address. If the "-" in the subdomain portion "1-2-3-4" string is replaced with ".", it becomes equivalent to the A record IP address "1.2.3.4".

[0048] For example, the subdomain of the domain name "host123.111.example.com" is "host123.111", which corresponds to its A record IP address. In the subdomain "host123", "123" corresponds to the last digit of the A record IP address, and "111" corresponds to the second to last digit of the A record IP address.

[0049] Based on the above research findings, in this embodiment, by comparing IP segmentation information and subdomain segmentation information, it can be determined whether the domain name to be identified is a domain name without actual business. This allows for the automatic and efficient identification of domain names without actual business, and the domain names without actual business in the expanded subdomain list can be removed, leaving only the domain names carrying actual business as targets for subsequent automated tool detection and manual penetration testing, thereby improving work efficiency.

[0050] In this embodiment, when segmenting the IP address of the domain name to be identified, the IP address can be segmented using a delimiter, such as a period (.), to obtain IP segmentation information. For example, taking the IP address "11.22.33.44" as an example, the segmented IP segmentation information is: ['11', '22', '33', '44'].

[0051] In this embodiment, the obtained IP segmentation information can be saved to the IP segmentation list.

[0052] In addition, please see Figure 2 The step of segmenting the subdomain portion of the domain name to be identified to obtain subdomain segmentation information can be achieved in the following way: S131, the subdomain partial string is divided into multiple character groups based on the delimiter in the subdomain partial string.

[0053] S132, the multiple character groups are filtered to obtain subdomain segmentation information composed of multiple character groups after filtering.

[0054] In this embodiment, the delimiters in the subdomain string may include symbols such as a period (.), a hyphen (-), and an underscore (_). The subdomain string is divided into multiple character groups using these delimiters. For example, if the extracted subdomain string is "ip-011-022-033_dynamic", the subdomain segmentation information obtained after segmentation based on the delimiters in the subdomain string is: ['ip', '011', '022', '033', 'dynamic']. The multiple characters included in the subdomain segmentation information can be understood as multiple character groups.

[0055] Based on this, multiple character groups can be filtered out. The filtering process can be carried out as follows: Remove non-numeric characters from multiple character groups; remove the leading zero from character groups containing leading zeros; delete character groups with empty elements.

[0056] As mentioned above, the subdomain segmentation information obtained after segmentation may include numeric characters and non-numeric characters. In order to match and compare with the IP address, it is necessary to delete the non-numeric characters.

[0057] Taking the above example, when the character group obtained after segmentation is ['ip', '011', '022', '033', 'dynamic'], the non-numeric characters in the character group are deleted, and the character group obtained after deletion is ['', '011', '022', '033', ''].

[0058] In addition, there are some character groups with a leading zero in the character group, such as "011" and "022". The leading zeros in the character groups with leading zeros can be deleted. The character group obtained after deletion is ['', '11', '22', '33', ''].

[0059] At this point, there may be some empty character groups. These character groups have no practical meaning. Therefore, we can delete the empty character groups. The character groups obtained after deletion are ['11', '22', '33'].

[0060] In this embodiment, the subdomain segmentation information, which is composed of multiple character groups, can be saved to a string list.

[0061] As shown above, when the number of IP addresses for the domain to be identified is not 1, it can be directly determined that the domain is not a domain without actual business operations. However, when the number of IP addresses for the domain to be identified is 1, it is impossible to make a determination at this time, and it is necessary to compare the IP segmentation information and the subdomain segmentation information to make a judgment.

[0062] In this embodiment, the IP segmentation information and subdomain segmentation information can be compared in the following way to determine whether the domain name to be identified is a domain name without actual business: If there is no character group in the multiple character groups that matches the last IP group in the multiple IP groups, or if there is no character group that matches the last IP group and the second to last IP group in the multiple IP groups respectively, then the domain name to be identified is determined to be a domain name without actual business.

[0063] If multiple character groups contain character groups that are identical to the last two IP groups in the multiple IP groups, then the domain name to be identified is determined to be a domain name without actual business based on the character groups that are identical to the last two IP groups in the multiple IP groups.

[0064] In this embodiment, research revealed that a second-level domain may contain multiple actual business domain names, and the A record IP addresses of these domain names without actual business operations are consecutive. That is, other IP addresses in the network segment where this IP address resides will correspond to domain names without actual business operations in the same format (in this case, these domain names and IP address network segments all belong to the same organization).

[0065] Therefore, in order to achieve the goal of establishing a correspondence between a domain name and an A record IP address, its subdomain portion must contain the penultimate digit of the IP address.

[0066] For example: The A record IP address for the domain host1.111.example.com is 111.111.111.1 The A record IP address for the domain host2.111.example.com is 111.111.111.2. ...... The A record IP address for the domain host192.111.example.com is 111.111.111.192. The IP address of the A record for the domain host193.111.example.com is 111.111.111.193. ...... The A record IP address for the domain host253.111.example.com is 111.111.111.253. The IP address of the A record for the domain host254.111.example.com is 111.111.111.254. The A record IP address for the domain host255.111.example.com is 111.111.111.255. As mentioned above, for domain names without actual business operations, since their subdomains correspond to the IP addresses of A records, there must be a character group in the multiple character groups in the subdomain segmentation information that matches the last IP group (i.e., the last digit of the IP address) in the IP group.

[0067] However, using the mere existence of a character group matching the last IP address in a character group as the sole criterion for determining if a domain has no actual business operation is not rigorous enough and is prone to false positives. Furthermore, a subdomain of a domain without actual business operation typically contains at least the last two digits of the IP address. Therefore, when determining if a domain has no actual business operation, both conditions must be met: multiple character groups must contain character groups corresponding to the last IP address in multiple IP groups, and multiple character groups must contain character groups corresponding to the second-to-last IP address in multiple IP groups.

[0068] Please see Figure 3 If the above two conditions are met, the following methods can be used to determine whether the domain name to be identified is a domain name without actual business operations: S141, determine the first position of the character group that matches the penultimate IP group in the plurality of character groups, and the second position of the character group that matches the second-to-last IP group in the plurality of character groups.

[0069] S142, Based on the first position and the second position, determine whether the domain name to be identified is a domain name without actual business.

[0070] In this embodiment, when the absolute value of the difference between the first position and the second position is 1, the domain name to be identified is determined to be a domain name without actual business.

[0071] If the absolute value of the difference between the first position and the second position is not 1, the domain name to be identified is determined to be a domain name without actual business.

[0072] For example, if the subdomain segmentation information of the domain name to be identified is ['120', '140', '160'], and the IP segmentation information is ['60', '70', '80', '90'].

[0073] As can be seen, the last IP group in the IP segmentation information is 90, while there is no character group with the number 90 in the subdomain segmentation information. Therefore, it can be determined that the domain name to be identified is not a domain name without actual business.

[0074] For example, if the subdomain segmentation information of the domain name to be identified is ['120', '90', '160'], and the IP segmentation information is ['60', '70', '80', '90'].

[0075] As can be seen, the last IP group in the IP segmentation information is the number 90, and the second to last IP group is the number 80. In the subdomain segmentation information, there is a character group with the number 90, but not a character group with the number 80. Therefore, it can be determined that the domain name to be identified is not a domain name without actual business operations.

[0076] For example, if the subdomain segmentation information of the domain name to be identified is ['70', '80', '90'], and the IP segmentation information is ['60', '70', '80', '90'].

[0077] As can be seen, the last IP group in the IP segmentation information is the number 90, and the second to last IP group is the number 80. The subdomain segmentation information contains a character group with the number 90, and this character group is positioned 3 among multiple character groups. Furthermore, the subdomain segmentation information contains a character group with the number 80, and this character group is positioned 2 among multiple character groups.

[0078] In this embodiment, research has revealed that for domains without actual business operations, there are two scenarios when the subdomain part corresponds to the IP address of the A record: one is to arrange the numbers in the IP address in ascending order, and the other is to arrange them in descending order.

[0079] For example, if the last digit in IP address segmentation list B is denoted as M in string list A, and the second-to-last digit in IP address segmentation list B is denoted as N in string list A, then MN = 1 if the numbers in the IP address are in ascending order, and NM = 1 if the numbers in the IP address are in descending order.

[0080] Therefore, in the example above, the position of the 90-character group in the subdomain segmentation information is 3, the position of the 80-character group is 2, and the difference between the two positions is 1. Therefore, it can be determined that the corresponding domain name to be identified is a domain name without actual business.

[0081] In addition, if the subdomain segmentation information of the domain name to be identified is ['80', '200', '90'], the IP segmentation information is ['60', '70', '80', '90'].

[0082] As can be seen, the last IP group in the IP segmentation information is the number 90, and the second to last IP group is the number 80. The subdomain segmentation information contains a character group with the number 90, and this character group is positioned 3 among multiple character groups. Furthermore, the subdomain segmentation information contains a character group with the number 80, and this character group is positioned 1 among multiple character groups. The difference between these two positions is 2. Therefore, it can be determined that the domain name to be identified is not a domain name without actual business operations.

[0083] The method for identifying domains without actual business operations provided in this embodiment determines whether a domain is a non-business domain by counting the number of IP addresses associated with its A records. Furthermore, when counting is insufficient, a segmentation method is designed to split the subdomain portion of the domain and the IP address portion. The segmented subdomain portion and the IP address are then compared to determine whether the domain is a non-business domain.

[0084] Combination Figure 4 As shown in the figure, the overall process of the domain name identification method without actual business provided in this embodiment is described below.

[0085] S21, obtain the IP address of the A record of the domain name to be identified.

[0086] S22, check if the number of IP addresses of the A record of the domain name to be identified is equal to 1. If it is not equal to 1, proceed to step S29. If it is equal to 1, proceed to step S23.

[0087] S23, the subdomain portion of the domain name to be identified is segmented to obtain subdomain segmentation information.

[0088] S24, segment the IP address of the A record of the domain name to be identified to obtain IP segmentation information.

[0089] S25, check if the last digit of the IP segmentation information exists in the subdomain segmentation information. If it exists, proceed to step S26; if it does not exist, proceed to step S29.

[0090] S26. Detect whether the second-to-last number in the IP segmentation information exists in the subdomain segmentation information. If it exists, proceed to step S27; if it does not exist, proceed to step S29.

[0091] S27. Check if the position difference between the strings corresponding to the last two digits in the subdomain segmentation information and the last two digits in the IP segmentation information is 1. If it is 1, proceed to step S28. If it is not 1, proceed to step S29.

[0092] S28, it is determined that the domain name to be identified is a domain name without actual business.

[0093] S29, it is determined that the domain name to be identified is not a domain name without actual business.

[0094] The above is the overall process of the domain name identification method without actual business provided in this embodiment. Based on the domain name string itself and the A record IP address of the domain name, a segmentation method is designed to segment the subdomain part of the domain name string, and a comparison and judgment method for subdomain segmentation information and IP segmentation information is designed to realize an automated identification method for domain names without actual business.

[0095] By automatically identifying domain names without actual business operations, it is possible to eliminate domain names without actual business operations and retain only those that carry actual business operations, thereby improving the efficiency of subsequent automated tool detection and manual penetration testing.

[0096] Please see Figure 5 The diagram below shows the structure of an electronic device provided in this application embodiment. The electronic device may include a memory 120, a processor 110, and a communication module 130. The memory 120, processor 110, and communication module 130 are electrically connected to each other directly or indirectly to achieve data transmission or interaction. For example, these components can be electrically connected to each other through one or more communication buses or signal lines.

[0097] The memory 120 is used to store programs or data. The memory 120 may be, but is not limited to, random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc.

[0098] The processor 110 is used to read / write data or programs stored in the memory 120 and execute the domain name identification method without actual business provided in any embodiment of this application.

[0099] The communication module 130 is used to establish a communication connection between the electronic device and other communication terminals via a network, and to send and receive data via the network.

[0100] It should be understood that, Figure 5 The structure shown is only a schematic diagram of an electronic device; the electronic device may also include components that are larger than those shown. Figure 5 The more or fewer components shown, or having the same Figure 5 The different configurations shown.

[0101] Based on the same inventive concept, please refer to Figure 6 This illustration shows a functional module diagram of the domain name identification device 140 without actual business provided in this application embodiment. This embodiment can divide the domain name identification device 140 without actual business into functional modules according to the above method embodiment. For example, each function can be divided into a separate functional module, or two or more functions can be integrated into one processing module.

[0102] The integrated modules described above can be implemented in hardware or as software functional modules. It should be noted that the module division in this embodiment is illustrative and represents only one logical functional division; in actual implementation, other division methods may be used.

[0103] For example, when dividing functional modules according to their respective functions, Figure 6 The illustrated device 140 for identifying domain names without actual business operations is merely a schematic diagram. This device 140 may include an acquisition module 141, an extraction module 142, a segmentation module 143, and a judgment module 144. The functions of each module of this device 140 will be described in detail below.

[0104] Module 141 is used to obtain the IP address corresponding to the domain name to be identified; It is understood that the acquisition module 141 can be used to perform the above step S11. For details on the implementation of the acquisition module 141, please refer to the relevant content of the above step S11.

[0105] Extraction module 142 is used to extract the subdomain part string of the domain name to be identified when the number of IP addresses corresponding to the domain name to be identified is equal to 1. It is understood that the extraction module 142 can be used to perform the above step S12. For details on the implementation of the extraction module 142, please refer to the relevant content of the above step S12.

[0106] The segmentation module 143 is used to segment the IP address to obtain IP segmentation information and to segment the subdomain part string to obtain subdomain segmentation information; It is understood that the segmentation module 143 can be used to perform the above step S13. For details on the implementation of the segmentation module 143, please refer to the relevant content of the above step S13.

[0107] The judgment module 144 is used to compare the IP segmentation information and the subdomain segmentation information to determine whether the domain name to be identified is a domain name without actual business.

[0108] It is understood that the judgment module 144 can be used to execute the above step S14. For details on the implementation of the judgment module 144, please refer to the relevant content of the above step S14.

[0109] In one possible implementation, the segmentation module 143 described above can be used to: The subfield portion string is divided into multiple character groups based on the delimiter in the subfield portion string; The multiple character groups are filtered out to obtain subdomain segmentation information composed of multiple character groups after filtering.

[0110] In one possible implementation, the segmentation module 143 described above can specifically be used for: Delete the non-numeric characters in the multiple character groups; Remove the leading zero from the character set containing the leading zero; Delete the character group containing the empty element.

[0111] In one possible implementation, the IP segmentation information consists of multiple IP groups, and the aforementioned judgment module 144 can be used for: If there is no character group in the plurality of character groups that matches the last IP group in the plurality of IP groups, or if there is no character group that matches the last IP group and the second to last IP group in the plurality of IP groups respectively, then the domain name to be identified is determined to be a domain name without actual business. If there are character groups among the plurality of character groups that are consistent with the last and second-to-last IP groups among the plurality of IP groups, then the domain name to be identified is determined to be a domain name without actual business based on the character groups that are consistent with the last and second-to-last IP groups among the plurality of IP groups.

[0112] In one possible implementation, the aforementioned judgment module 144 can be used to: Determine the first position of the character group that matches the last IP group in the plurality of character groups, and the second position of the character group that matches the second-to-last IP group in the plurality of character groups; Based on the first and second positions, it is determined whether the domain name to be identified is a domain name without actual business.

[0113] In one possible implementation, the aforementioned judgment module 144 can specifically be used for: When the absolute value of the difference between the first position and the second position is 1, the domain name to be identified is determined to be a domain name without actual business. If the absolute value of the difference between the first position and the second position is not 1, the domain name to be identified is determined to be a domain name without actual business.

[0114] In one possible implementation, the determination module 144 can also be used for: If the number of IP addresses corresponding to the domain name to be identified is greater than 1, it is determined that the domain name to be identified is not a domain name without actual business.

[0115] The processing flow of each module in the device and the interaction flow between each module can be referred to the relevant descriptions in the above method embodiments, and will not be detailed here.

[0116] Furthermore, embodiments of this application also provide a computer-readable storage medium storing machine-executable instructions, which, when executed, implement the domain name identification method without actual business provided in the above embodiments.

[0117] Specifically, the computer-readable storage medium can be a general-purpose storage medium, such as a removable disk or hard disk. When the computer program on the computer-readable storage medium is executed, it can perform the aforementioned method for identifying domain names without actual business information. The processes involved in the execution of the executable instructions on the computer-readable storage medium can be referred to the relevant descriptions in the above method embodiments, and will not be detailed here.

[0118] In summary, the method, apparatus, electronic device, and readable storage medium for identifying domains without actual business operations provided in this application obtain the IP address corresponding to the domain name to be identified. When the number of corresponding IP addresses is equal to one, the subdomain portion of the domain name to be identified is extracted. The IP address is then segmented to obtain IP segmentation information, and the subdomain portion string is segmented to obtain subdomain segmentation information. By comparing the IP segmentation information and the subdomain segmentation information, it is determined whether the domain name to be identified is a domain name without actual business operations. This solution analyzes the inherent relationship between the subdomain portion and the IP address in a domain name without actual business operations, thereby accurately determining whether a domain name to be identified is a domain name without actual business operations based on the subdomain portion and the IP address, thus improving the efficiency of automated tool detection and manual penetration testing.

[0119] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for identifying domain names without actual business operations, characterized in that, The method includes: Obtain the IP address corresponding to the domain name to be identified; If the number of IP addresses corresponding to the domain name to be identified is equal to 1, extract the subdomain part string of the domain name to be identified; The IP address is segmented to obtain IP segmentation information, and the subdomain part of the string is segmented to obtain subdomain segmentation information; The IP segmentation information and subdomain segmentation information are compared to determine whether the domain name to be identified is a domain name without actual business.

2. The method for identifying domain names without actual business operations according to claim 1, characterized in that, The step of segmenting the subdomain portion of the string to obtain subdomain segmentation information includes: The subfield portion string is divided into multiple character groups based on the delimiter in the subfield portion string; The multiple character groups are filtered out to obtain subdomain segmentation information composed of multiple character groups after filtering.

3. The method for identifying domain names without actual business operations according to claim 2, characterized in that, The step of filtering out the multiple character groups includes: Delete the non-numeric characters in the multiple character groups; Remove the leading zero from the character set containing the leading zero; Delete the character group containing the empty element.

4. The method for identifying domain names without actual business operations according to claim 2, characterized in that, The IP segmentation information consists of multiple IP groups; The step of comparing the IP segmentation information and the subdomain segmentation information to determine whether the domain name to be identified is a domain name without actual business operations includes: If there is no character group in the plurality of character groups that matches the last IP group in the plurality of IP groups, or if there is no character group that matches the last IP group and the second to last IP group in the plurality of IP groups respectively, then the domain name to be identified is determined to be a domain name without actual business. If there are character groups among the plurality of character groups that are consistent with the last and second-to-last IP groups among the plurality of IP groups, then the domain name to be identified is determined to be a domain name without actual business based on the character groups that are consistent with the last and second-to-last IP groups among the plurality of IP groups.

5. The method for identifying domain names without actual business operations according to claim 4, characterized in that, The step of determining whether the domain name to be identified is a domain name without actual business use based on the character groups that match the penultimate IP group and the penultimate IP group in the plurality of IP groups includes: Determine the first position of the character group that matches the last IP group in the plurality of character groups, and the second position of the character group that matches the second-to-last IP group in the plurality of character groups; Based on the first and second positions, it is determined whether the domain name to be identified is a domain name without actual business.

6. The method for identifying domain names without actual business operations according to claim 5, characterized in that, The step of determining whether the domain name to be identified is a domain name without actual business operations based on the first position and the second position includes: When the absolute value of the difference between the first position and the second position is 1, the domain name to be identified is determined to be a domain name without actual business. If the absolute value of the difference between the first position and the second position is not 1, the domain name to be identified is determined to be a domain name without actual business.

7. The method for identifying domain names without actual business operations according to claim 1, characterized in that, The method further includes: If the number of IP addresses corresponding to the domain name to be identified is greater than 1, it is determined that the domain name to be identified is not a domain name without actual business.

8. A device for identifying domain names without actual business operations, characterized in that, The device includes: The acquisition module is used to obtain the IP address corresponding to the domain name to be identified; The extraction module is used to extract the subdomain portion string of the domain name to be identified when the number of IP addresses corresponding to the domain name to be identified is equal to 1. The segmentation module is used to segment the IP address to obtain IP segmentation information and to segment the subdomain part string to obtain subdomain segmentation information; The judgment module is used to compare the IP segmentation information and the subdomain segmentation information to determine whether the domain name to be identified is a domain name without actual business.

9. An electronic device, characterized in that, The device includes one or more storage media and one or more processors communicating with the storage media. The one or more storage media store machine-executable instructions that can be executed by the processor. When the electronic device is running, the processor executes the machine-executable instructions to perform the steps of the method according to any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1-7.

Images