Method and apparatus for identifying DoH service, electronic device and storage medium

Abstract

The method and device for identifying DoH service, the electronic device and the storage medium are disclosed, wherein the method comprises: sending a first domain name resolution request to a domain name resolution server at a preset detection frequency, the first domain name resolution request being used to request a DoH-based domain name resolution service for a first detection domain name; updating a target network address corresponding to the first detection domain name in a database according to each first resolution result; comparing a network address in the database with a network address to be queried in a domain name resolution service type query request when the domain name resolution service type query request is received; and determining that the domain name resolution service in the domain name resolution service type query request is the DoH-based domain name resolution service when there is a network address same as the network address to be queried in the database.

Description

Technical Field

[0001] This disclosure relates to the field of domain name query technology, and in particular to a method and apparatus for identifying DoH services, electronic devices, and storage media. Background Technology

[0002] Domain name resolution services based on DoH (DoH) are widely used due to their good privacy features. However, in practice, the protocol characteristics and technical principles of DoH make them highly concealed, often hiding within HTTPS (Hypertext Transfer Protocol over Secure) traffic, making them difficult to detect. This also means that malicious DoH-based domain name resolution services cannot be identified, posing a security risk to the domain name resolution server. Therefore, how to quickly and efficiently identify whether a domain name resolution service is based on DoH is a problem that urgently needs to be solved. Summary of the Invention

[0003] To address the aforementioned issues, this disclosure provides a method and apparatus for identifying DoH services, an electronic device, and a storage medium.

[0004] One aspect of this disclosure provides a method for identifying DoH services, comprising: sending a first domain name resolution request to a domain name resolution server at a preset detection frequency, the first domain name resolution request being used to request a DoH-based domain name resolution service for a first probe domain name; receiving a first resolution result returned by the domain name resolution server for each first domain name resolution request, the first resolution result including whether the domain name resolution was successful; updating a target network address corresponding to the first probe domain name in a database based on the first resolution result for each first resolution result, the database including multiple network addresses, each network address corresponding to a DoH-based domain name resolution service; in response to receiving a domain name resolution service type query request, comparing the network address to be queried in the domain name resolution service type query request with the network address in the database; in response to the existence of a network address in the database that is the same as the network address to be queried, determining that the domain name resolution service in the domain name resolution service type query request is a DoH-based domain name resolution service.

[0005] In another aspect of this disclosure, a DoH service identification device is provided, comprising: a first detection module, configured to send a first domain name resolution request to a domain name resolution server at a preset detection frequency, the first domain name resolution request being used to request a DoH-based domain name resolution service for a first probed domain name; a first receiving module, configured to receive a first resolution result returned by the domain name resolution server for each first domain name resolution request, the first resolution result including whether the domain name resolution was successful; an update module, configured to update the target network address corresponding to the first probed domain name in a database according to each first resolution result, the database including multiple network addresses, each network address corresponding to a DoH-based domain name resolution service; a comparison module, configured to compare the network address to be queried in the domain name resolution service type query request with the network address in the database in response to receiving a domain name resolution service type query request; and an identification module, configured to determine that the domain name resolution service in the domain name resolution service type query request is a DoH-based domain name resolution service in response to the existence of a network address identical to the network address to be queried in the database.

[0006] In another aspect of this disclosure, an electronic device is provided, comprising: a memory for storing a computer program; and a processor for executing the computer program stored in the memory, wherein when the computer program is executed, a method for identifying DoH services is implemented.

[0007] In another aspect of this disclosure, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements a method for identifying DoH services.

[0008] In this embodiment of the disclosure, the network address to be queried is compared with the network address of the corresponding DoH-based domain name resolution service in the database. When the database stores a network address that is the same as the network address to be queried, it is determined that the domain name resolution service in the domain name resolution service type query request is a DoH-based domain name resolution service. This achieves efficient and accurate identification of whether the domain name resolution service is a DoH-based domain name resolution service.

[0009] Furthermore, in this embodiment, an active probing method is used, i.e., a first domain name resolution request is sent to the domain name resolution server at a preset probing frequency. This first domain name resolution request is used to request a Domain Name Resolution Service (DoH) based on the first probe domain name. A first resolution result is obtained for each first domain name resolution request, and each first resolution result includes whether the domain name resolution was successful. Based on each first resolution result, the target network address corresponding to the first probe domain name in the database is updated. This achieves timely updates to the network addresses in the database, ensuring that the domain names corresponding to the network addresses in the database are resolved using a DoH-based domain name service, thereby improving the accuracy of determining the domain name resolution service type through the network addresses in the database.

[0010] The technical solutions of this disclosure will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0011] The accompanying drawings, which form part of this specification, illustrate embodiments of this disclosure and, together with the description, serve to explain the principles of this disclosure.

[0012] This disclosure will become clearer with reference to the accompanying drawings and the following detailed description, wherein:

[0013] Figure 1 This is a flowchart illustrating a DoH service identification method provided in an exemplary embodiment of this disclosure;

[0014] Figure 2 This is a flowchart illustrating a DoH service identification method provided in another exemplary embodiment of this disclosure;

[0015] Figure 3 This is a flowchart illustrating step S210 provided in an exemplary embodiment of this disclosure;

[0016] Figure 4 This is a structural block diagram of a DoH service identification device provided in an exemplary embodiment of the present disclosure;

[0017] Figure 5 This is a schematic diagram of the structure of an application embodiment of the electronic device disclosed herein. Detailed Implementation

[0018] Various exemplary embodiments of the present disclosure will now be described in detail with reference to the accompanying drawings. It should be noted that, unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present disclosure.

[0019] Those skilled in the art will understand that the terms "first," "second," etc., in the embodiments of this disclosure are only used to distinguish different steps, devices, or modules, and do not represent any specific technical meaning, nor do they indicate a necessary logical order between them.

[0020] It should also be understood that in the embodiments disclosed herein, "a plurality of" may refer to two or more, and "at least one" may refer to one, two or more.

[0021] It should also be understood that any component, data or structure mentioned in the embodiments of this disclosure can generally be understood as one or more unless expressly defined or given to the contrary in the context.

[0022] Furthermore, the term "and / or" in this disclosure is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this disclosure generally indicates that the preceding and following related objects have an "or" relationship.

[0023] It should also be understood that the description of the various embodiments in this disclosure emphasizes the differences between the various embodiments, and the similarities or similarities can be referred to each other. For the sake of brevity, they will not be described in detail.

[0024] At the same time, it should be understood that, for ease of description, the dimensions of the various parts shown in the accompanying drawings are not drawn according to actual scale.

[0025] The following description of at least one exemplary embodiment is merely illustrative and is in no way intended to limit this disclosure or its application or use.

[0026] Techniques, methods, and equipment known to those skilled in the art may not be discussed in detail, but where appropriate, such techniques, methods, and equipment should be considered part of the specification.

[0027] It should be noted that similar labels and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be discussed further in subsequent figures.

[0028] The embodiments disclosed herein can be applied to electronic devices such as terminal devices, computer systems, and servers, and can operate together with a wide range of other general-purpose or special-purpose computing system environments or configurations. Examples of well-known terminal devices, computing systems, environments, and / or configurations suitable for use with electronic devices such as terminal devices, computer systems, and servers include, but are not limited to: personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputer systems, mainframe computer systems, and distributed cloud computing environments including any of the above systems, etc.

[0029] Electronic devices such as terminal devices, computer systems, and servers can be described in the general context of computer system executable instructions (such as program modules) executed by a computer system. Typically, program modules can include routines, programs, object programs, components, logic, data structures, etc., which perform specific tasks or implement specific abstract data types. Computer systems / servers can be implemented in distributed cloud computing environments, where tasks are executed by remote processing devices linked through communication networks. In distributed cloud computing environments, program modules can reside on local or remote computing system storage media, including storage devices.

[0030] In the embodiments disclosed herein:

[0031] DNS (Domain Name System) is an internet service that acts as a distributed database that maps domain names to IP (Internet Protocol Address) addresses, making it easier for users to access the internet.

[0032] DoH (DNS over HTTPS) is a secure domain name resolution scheme that uses the HTTPS and HTTP / 2 protocols for DNS resolution requests.

[0033] HTTPS (Hyper Text Transfer Protocol over Secure) is a transmission protocol for secure communication over computer networks.

[0034] A URL (Uniform Resource Locator) address, or simply a webpage address, is a string used to fully describe the address of a webpage and other resources.

[0035] Figure 1This is a flowchart illustrating a DoH service identification method provided in an exemplary embodiment of this disclosure. This embodiment can be applied to electronic devices, such as... Figure 1 As shown, it includes the following steps:

[0036] Step S110: Send a first domain name resolution request to the domain name resolution server at a preset detection frequency.

[0037] The first domain name resolution request is used to request a DoH-based domain name resolution service for the first probe domain name.

[0038] A domain name resolution server can be a DNS server, which is used to resolve domain names to obtain the corresponding IP addresses. The preset probe frequency means requesting the first domain name resolution request to the domain name resolution server once every preset time interval. For example, the preset probe frequency could include: requesting a DoH-based domain name resolution service for the first probe domain name to the domain name resolution server once every 10 minutes.

[0039] Domain name resolution service based on DoH can be understood as a domain name resolution server resolving a domain name based on DoH to obtain the IP address corresponding to that domain name.

[0040] In one specific implementation, a node management center and probe nodes can be pre-created. The node management center includes a database, and both the node management center and the domain name probe nodes can be computing devices such as computers, servers, and smartphones. The database includes: multiple network addresses, the domain names corresponding to each network address, and a table showing the mapping between network addresses and domain names. The multiple network addresses included in the database are all URL addresses.

[0041] The node management center can obtain at least one domain name from the database as the first probe domain name and assign it to the probe node. The probe node sends the first domain name resolution request to the domain name resolution server at a preset probe frequency.

[0042] Step S120: Receive the first resolution result returned by the domain name resolution server for each first domain name resolution request.

[0043] The first resolution result includes whether the domain name resolution was successful, that is, whether the domain name resolution server successfully resolved the first probe domain name based on DoH.

[0044] In one specific implementation, the probe node receives the first resolution result returned by the domain name resolution server for each first domain name resolution request. When the first resolution result includes the IP address corresponding to the first probe domain name, it is determined that the domain name resolution server has successfully resolved the first probe domain name based on DoH (domain name resolution successful). When the first resolution result does not include the IP address corresponding to the first probe domain name, it is determined that the domain name resolution server has failed to resolve the first probe domain name based on DoH (domain name resolution failed).

[0045] Step S130: For each first resolution result, update the target network address in the database corresponding to the first probe domain name based on the first resolution result. In the disclosed embodiment, the network address in the database corresponding to the first probe domain name is referred to as the target network address.

[0046] The database contains multiple network addresses, each corresponding to a Domain Name System (DoH) based domain name resolution service. This can be understood as the domain name resolution service for the domain name corresponding to that network address being based on DoH.

[0047] All network addresses in the database are URLs, and correspondingly, the target network address is also a URL.

[0048] In one optional implementation, the probe node sends each received first resolution result to the node management center. The node management center determines whether the domain name resolution server has successfully resolved the first probe domain name based on the first resolution result. When it is determined that the server has failed to resolve the first probe domain name based on the DoH, the target network address corresponding to the first probe domain name is determined through the mapping table between network addresses and domain names, and the target network address corresponding to the first probe domain name is deleted from the database. After the target network address corresponding to the first probe domain name is deleted from the database, the probe node stops sending the first domain name resolution request for the probe domain name to the domain name resolution server, that is, it stops probing whether the first probe domain name can be resolved based on the DoH.

[0049] Step S140: In response to receiving a domain name resolution service type query request, compare the network address to be queried in the domain name resolution service type query request with the network address in the database.

[0050] This domain name resolution service query request includes the network address to be queried. The network address to be queried can be a URL.

[0051] In one specific implementation, when a domain name resolution service type query request is received, all network addresses in the database can be compared with the network address to be queried to determine whether there is a network address in the database that is the same as the network address to be queried.

[0052] Step S150: In response to the existence of a network address in the database that is the same as the network address to be queried, determine that the domain name resolution service in the domain name resolution service type query request is a domain name resolution service based on DoH.

[0053] This domain name resolution service query request also includes: domain name resolution service. This domain name resolution service includes the domain name corresponding to the network address to be queried.

[0054] In this embodiment of the disclosure, the network address to be queried is compared with the network address of the corresponding DoH-based domain name resolution service in the database. When the database stores a network address that is the same as the network address to be queried, it is determined that the domain name resolution service in the domain name resolution service type query request is a DoH-based domain name resolution service. This achieves efficient and accurate identification of whether the domain name resolution service is a DoH-based domain name resolution service.

[0055] Furthermore, in this embodiment, an active probing method is used, i.e., a first domain name resolution request is sent to the domain name resolution server at a preset probing frequency. This first domain name resolution request is used to request a Domain Name Resolution Service (DoH) based on the first probe domain name. A first resolution result is obtained for each first domain name resolution request, and each first resolution result includes whether the domain name resolution was successful. Based on each first resolution result, the target network address corresponding to the first probe domain name in the database is updated. This achieves timely updates to the network addresses in the database, ensuring that the domain names corresponding to the network addresses in the database are resolved using a DoH-based domain name service, thereby improving the accuracy of determining the domain name resolution service type through the network addresses in the database.

[0056] Figure 2 This is a flowchart illustrating a DoH service identification method provided in another exemplary embodiment of this disclosure. In some alternative implementations, such as... Figure 2 As shown, it also includes the following steps:

[0057] Step S210: Obtain multiple second probe domain names.

[0058] This involves obtaining multiple domain names from the DNS server as second probe domain names. For example, the node management center can obtain multiple domain names from the DoH-based DNS service as second probe domain names.

[0059] Step S220: Send a second domain name resolution request to the domain name resolution server for each second probe domain name.

[0060] The second domain name resolution request is used to request a DoH-based domain name resolution service for the second probe domain name.

[0061] In one specific implementation, the node management center can assign each second probe domain name to the probe node, so that the probe node can send a second domain name resolution request to the domain name resolution server for each second probe domain name.

[0062] Step S230: Receive the second resolution result from the domain name resolution server in response to the second domain name resolution request.

[0063] The second resolution result includes whether the domain name resolution server successfully resolved the second probe domain name based on DoH.

[0064] In one specific implementation, the probe node receives a second resolution result sent by the domain name resolution server. If the second resolution result includes the IP address corresponding to the second probe domain name, it is determined that the domain name resolution server has successfully resolved the second probe domain name based on DoH; if the second resolution result does not include the IP address corresponding to the second probe domain name, it is determined that the domain name resolution server has failed to resolve the second probe domain name based on DoH.

[0065] Step S240: In response to the second resolution result indicating that the second probe domain name was successfully resolved, the network address corresponding to the second probe domain name is stored in the database.

[0066] In one specific implementation, the probe node sends the received second resolution result to the node management center. The node management center determines whether the domain name resolution server has successfully resolved the second probe domain name based on the second resolution result. If the resolution of the second probe domain name is successful, the network address corresponding to the second probe domain name is stored in the database. If the resolution of the second probe domain name fails, the second probe domain name is deleted.

[0067] Figure 3 This is a flowchart illustrating step S210 provided in an exemplary embodiment of this disclosure. In some alternative embodiments, such as Figure 3 As shown, step S210 includes the following steps:

[0068] Step S211: Obtain multiple domain name resolution logs.

[0069] Among them, any one of the multiple domain name resolution logs includes: the domain name to be resolved and the network address corresponding to the domain name to be resolved. The network address corresponding to the domain name to be resolved can be a URL address.

[0070] In one specific implementation, the node management center can obtain multiple domain name resolution logs corresponding to port (53) of the domain name resolution server. Each domain name resolution log may also include: source IP address, destination IP address, and IP address of the resolution server. Among them, the source IP address is the IP address of the user who sent the domain name to be resolved, the destination IP address is the IP address corresponding to the domain name to be resolved, and the IP address of the resolution server is the IP address of the domain name resolution server responsible for resolving the domain name to be resolved.

[0071] Step S212: Obtain multiple second probe domains based on multiple domain name resolution logs.

[0072] In one alternative implementation, the domain name to be resolved in each domain name resolution log is used as a second probe domain name.

[0073] In some optional implementations, any domain name resolution log in this disclosure embodiment further includes: access time information. The access time information includes the time when the domain name server receives the domain name to be resolved from the domain name resolution log. For example, the access time information may include a timestamp when the domain name resolution server receives the domain name to be resolved.

[0074] Accordingly, in an embodiment, step S212 may include: determining the peak period of domain name resolution based on access time information in multiple domain name resolution logs; and then determining multiple second probe domain names based on the domain name resolution logs corresponding to the peak period.

[0075] The peak period for domain name resolution refers to the peak period for requests to resolve domain names.

[0076] A time analysis method can be pre-set. Using this method, based on the access time information of each domain name resolution day, the time sequence characteristics of each domain name resolution log can be analyzed to determine the peak period.

[0077] In one specific implementation, the time analysis method may include: pre-setting multiple preset time periods, determining the preset time period corresponding to each domain name resolution log based on the access time information in each preset time period and each domain name resolution log, and taking the N preset time periods with the most domain name resolution logs corresponding to the preset time periods as peak time periods.

[0078] For example, suppose three preset time periods are set, namely 18:00~22:00, 22:01~2:00, and 2:01~6:00; the access time information in domain name resolution log 1 is 21:07, the access time information in domain name resolution log 2 is 21:21, the access time information in domain name resolution log 3 is 19:08, and the access time information in domain name resolution log 4 is 22:30; N=1.

[0079] Since the preset time period of 18:00 to 22:00 corresponds to the most domain name resolution logs, namely domain name resolution log 1, domain name resolution log 2 and domain name resolution log 3, the preset time period of 18:00 to 22:00 is determined to be the peak period.

[0080] In some optional implementations, any domain name resolution log in this disclosure embodiment further includes: user internet access operation information. This user internet access operation information includes user actions performed on websites corresponding to the IP address of the domain name to be resolved. For example, user internet access operation information may include: page turning, double-clicking, downloading text, copying text, webpage dwell time, etc.

[0081] Accordingly, in an embodiment, determining multiple second probe domain names based on the domain name resolution logs corresponding to the peak period may include: determining the target domain name resolution logs corresponding to non-virtual users based on user internet access operation information in the domain name resolution logs corresponding to the peak period; and then determining multiple second probe domain names based on the target domain name resolution logs.

[0082] In one optional implementation, when a user's internet access operation information includes page turning, mouse clicks, or a dwell time exceeding a preset duration, the user corresponding to the domain name resolution log containing the user's internet access operation information is determined to be a real, non-virtual user, not a virtual user accessing the internet through a virtual IP address.

[0083] In some optional implementations, any domain name resolution log in this disclosure embodiment further includes: the IP address (Internet Protocol address) of the domain name resolution server corresponding to the domain name to be resolved. The domain name resolution server corresponding to the domain name to be resolved is the domain name resolution server responsible for performing domain name resolution on the domain name to be resolved.

[0084] Accordingly, in an embodiment, step S220 may include: sending a second domain name resolution request to the domain name resolution server corresponding to the second probe domain name based on the IP address (Internet Protocol address) of the domain name resolution server corresponding to the second probe domain name.

[0085] When the domain name to be resolved in the domain name resolution log is identified as the second probe domain name, the domain name resolution server corresponding to the domain name to be resolved is the domain name resolution server corresponding to the second probe domain name.

[0086] In one specific implementation, the node management center can construct an IP address list based on the IP address of the domain name resolution server corresponding to each second probe domain name, and send the IP list and multiple second probe domain names to the probe nodes. The probe nodes, based on each IP address in the IP address list, send a second domain name resolution request for each second probe domain name to the domain name resolution server corresponding to each second probe domain name.

[0087] Accordingly, in this embodiment, step S240 may further include: storing the IP address of the domain name resolution server corresponding to the second probe domain name in the database. That is, when the second resolution result indicates that the second probe domain name is successfully resolved based on DoH, the IP address of the domain name resolution server corresponding to the second probe domain name is stored in the database.

[0088] In some optional implementations, the database in this embodiment of the disclosure also includes the IP address (Internet Protocol address) of the domain name resolution server corresponding to the first probe domain name. The domain name resolution server corresponding to the first probe domain name is the domain name resolution server responsible for resolving the domain name of the first probe domain name.

[0089] Accordingly, in an embodiment, step S110 may include: sending a first domain name resolution request to the domain name resolution server corresponding to the first probe domain name at a preset probe frequency, based on the IP address of the domain name resolution server corresponding to the first probe domain name.

[0090] In one specific implementation, the database includes the IP addresses of multiple domain name resolution servers, as well as the mapping between domain names and the IP addresses of these servers. The node management center can determine the IP address of the domain name resolution server corresponding to the first probe domain name using this mapping, and then send this IP address to the probe node. This allows the probe node to send a first domain name resolution request to the corresponding domain name resolution server based on that IP address.

[0091] Figure 4 This is a structural block diagram of a DoH service identification device provided in an exemplary embodiment of this disclosure. Figure 4 The DoH service identification device shown includes:

[0092] The first detection module 310 is used to send a first domain name resolution request to the domain name resolution server at a preset detection frequency. The first domain name resolution request is used to request domain name resolution service based on DoH for the first probe domain name.

[0093] The first receiving module 320 is used to receive the first resolution result returned by the domain name resolution server for each first domain name resolution request, wherein the first resolution result includes whether the domain name resolution was successful.

[0094] The update module 330 is used to update the target network address in the database corresponding to the first probe domain name according to each first resolution result. The database includes multiple network addresses, each of which corresponds to a domain name resolution service based on DoH.

[0095] Comparison module 340 is used to compare the network address to be queried in the domain name resolution service type query request with the network address in the database in response to receiving the domain name resolution service type query request;

[0096] The identification module 350 is used to determine that the domain name resolution service in the domain name resolution service type query request is a DoH-based domain name resolution service in response to the existence of a network address in the database that is the same as the network address to be queried.

[0097] In one embodiment of this disclosure, the DoH service identification device in this embodiment further includes:

[0098] The acquisition module is used to acquire multiple second probe domains;

[0099] The second detection module is used to send a second domain name resolution request to the domain name resolution server for each second detection domain name. The second domain name resolution request is used to request domain name resolution service based on DoH for the second detection domain name.

[0100] The second receiving module is used to receive the second resolution result fed back by the domain name resolution server in response to the second domain name resolution request;

[0101] The first storage module is configured to store the network address corresponding to the second probe domain name in the database in response to the second resolution result indicating that the second probe domain name has been successfully resolved.

[0102] In one embodiment of this disclosure, the acquisition module includes:

[0103] The first acquisition submodule is used to acquire multiple domain name resolution logs, each domain name resolution log including: the domain name to be resolved and the network address corresponding to the domain name to be resolved;

[0104] The second acquisition submodule is used to acquire the multiple second probe domain names based on the multiple domain name resolution logs.

[0105] In one embodiment of this disclosure, any domain name resolution log in this embodiment further includes: access time information; the second acquisition submodule in this embodiment includes:

[0106] The time period determination unit is used to determine the peak time period of domain name resolution based on the access time information in the multiple domain name resolution logs;

[0107] The domain name determination unit is used to determine the plurality of second probe domain names based on the domain name resolution logs corresponding to the peak period.

[0108] In one embodiment of this disclosure, any domain name resolution log in this embodiment further includes: user internet access operation information; the domain name determination unit in this embodiment is specifically used for:

[0109] Based on the user internet access operation information in the domain name resolution logs corresponding to the peak period, determine the target domain name resolution logs corresponding to non-virtual users;

[0110] Based on the target domain name resolution log, the plurality of second probe domain names are determined.

[0111] In one embodiment of this disclosure, any domain name resolution log in this embodiment further includes: the Internet Protocol address of the domain name resolution server corresponding to the domain name to be resolved;

[0112] The second detection module in this embodiment is specifically used to send the second domain name resolution request to the domain name resolution server corresponding to the second detection domain name based on the Internet Protocol address of the domain name resolution server corresponding to the second detection domain name;

[0113] The DoH service identification device in this embodiment of the disclosure further includes:

[0114] The second storage module is used to store the Internet Protocol address of the domain name resolution server corresponding to the second probed domain name into the database.

[0115] In one embodiment of this disclosure, the database in this embodiment further includes the Internet Protocol address of the domain name resolution server corresponding to the first probe domain name;

[0116] In this embodiment of the present disclosure, the first detection module 310 is specifically used to send the first domain name resolution request to the domain name resolution server corresponding to the first detection domain name at the preset detection frequency, based on the Internet Protocol address of the domain name resolution server corresponding to the first detection domain name.

[0117] The DoH service identification device of this disclosure corresponds to the DoH service identification method described above, and the relevant content can be referred to each other. It will not be repeated here.

[0118] The beneficial technical effects of the exemplary embodiments of the DoH service identification device of this disclosure can be found in the corresponding beneficial technical effects of the exemplary method section above, and will not be repeated here.

[0119] In addition, this disclosure also provides an electronic device, including:

[0120] Memory, used to store computer programs;

[0121] A processor is configured to execute a computer program stored in the memory, wherein when the computer program is executed, it implements the DoH service identification method described in any of the above embodiments of this disclosure.

[0122] Figure 5 This is a schematic diagram illustrating the structure of an application embodiment of the electronic device disclosed herein. Below, reference is made to… Figure 5 This describes an electronic device according to embodiments of the present disclosure. The electronic device may be either or both of a first device and a second device, or a standalone device independent of them, which may communicate with the first device and the second device to receive acquired input signals from them.

[0123] like Figure 5 As shown, the electronic device includes one or more processors and memory.

[0124] A processor can be a central processing unit (CPU) or other form of processing unit with data processing and / or instruction execution capabilities, and can control other components in an electronic device to perform desired functions.

[0125] The memory may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor may execute the program instructions to implement the DoH service identification method and / or other desired functions described in the various embodiments of this disclosure above.

[0126] In one example, the electronic device may also include input devices and output devices, which are interconnected via a bus system and / or other forms of connection mechanism (not shown).

[0127] In addition, the input device may include, for example, a keyboard, a mouse, etc.

[0128] This output device can output various information to the outside, including determined distance information, direction information, etc. The output device may include, for example, a display, a speaker, a printer, and a communication network and its connected remote output devices, etc.

[0129] Of course, for the sake of simplicity, Figure 5 Only some of the components of the electronic device relevant to this disclosure are shown, omitting components such as buses, input / output interfaces, etc. In addition, the electronic device may include any other suitable components depending on the specific application.

[0130] In addition to the methods and apparatus described above, embodiments of this disclosure may also be computer program products comprising computer program instructions that, when executed by a processor, cause the processor to perform the steps in the DoH service identification methods according to various embodiments of this disclosure as described in the foregoing portions of this specification.

[0131] The computer program product can be written in any combination of one or more programming languages ​​to perform the operations of the embodiments of this disclosure. The programming languages ​​include object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on a user's computing device, partially on a user's computing device, as a standalone software package, partially on a user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0132] Furthermore, embodiments of this disclosure may also be computer-readable storage media storing computer program instructions that, when executed by a processor, cause the processor to perform the steps in the DoH service identification method according to various embodiments of this disclosure as described in the foregoing portion of this specification.

[0133] The computer-readable storage medium may be any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may, for example, include, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatuses, or devices, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0134] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media that can store program code, such as ROM, RAM, magnetic disk, or optical disk.

[0135] The basic principles of this disclosure have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in this disclosure are merely examples and not limitations, and should not be considered as essential features of each embodiment of this disclosure. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the scope of this disclosure to the necessity of employing the aforementioned specific details for implementation.

[0136] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For system embodiments, since they largely correspond to method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0137] The block diagrams of devices, apparatuses, devices, and systems disclosed herein are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, devices, and systems can be connected, arranged, and configured in any manner. Words such as “comprising,” “including,” “having,” etc., are open-ended terms meaning “including but not limited to,” and are used interchangeably with them. The terms “or” and “and” as used herein refer to the terms “and / or,” and are used interchangeably with them unless the context clearly indicates otherwise. The term “such as” as used herein refers to the phrase “such as but not limited to,” and is used interchangeably with it.

[0138] The methods and apparatus of this disclosure may be implemented in many ways. For example, they may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above-described order of steps for the methods is for illustrative purposes only, and the steps of the methods of this disclosure are not limited to the order specifically described above unless otherwise specifically stated. Furthermore, in some embodiments, this disclosure may also be implemented as a program recorded on a recording medium, the program including machine-readable instructions for implementing the methods according to this disclosure. Thus, this disclosure also covers recording media storing programs for performing the methods according to this disclosure.

[0139] It should also be noted that in the apparatus, devices, and methods of this disclosure, the components or steps can be disassembled and / or recombined. These disassemblies and / or recombinations should be considered as equivalent solutions to this disclosure.

[0140] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of this disclosure. Therefore, this disclosure is not intended to be limited to the aspects shown herein, but rather to be carried out within the widest scope consistent with the principles and novel features disclosed herein.

[0141] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this disclosure to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations therein.

Claims

1. A method for identifying DoH services, characterized in that, include: The system retrieves multiple domain name resolution logs, each log including a domain name to be resolved and its corresponding network address; it retrieves multiple second probe domain names based on the logs; for each probe domain name, it sends a second domain name resolution request to a domain name resolution server, requesting a DoH-based domain name resolution service for the probe domain name; it receives a second resolution result from the domain name resolution server in response to the second resolution request; and in response to the second resolution result indicating successful resolution of the second probe domain name, it stores the network address corresponding to the second probe domain name in a database. At a preset detection frequency, a first domain name resolution request is sent to the domain name resolution server. The first domain name resolution request is used to request domain name resolution service based on DoH for the first probe domain name. The system receives the first resolution result returned by the domain name resolution server for each first domain name resolution request, and the first resolution result includes whether the domain name resolution was successful. For each first resolution result, the target network address corresponding to the first probe domain name in the database is updated according to the first resolution result. The database includes multiple network addresses, each of which corresponds to a domain name resolution service based on DoH. In response to receiving a domain name resolution service type query request, the network address to be queried in the domain name resolution service type query request is compared with the network address in the database; In response to the existence of a network address in the database that is identical to the network address to be queried, it is determined that the domain name resolution service in the domain name resolution service type query request is a Domain Name Resolution Service based on DoH.

2. The method according to claim 1, characterized in that, The domain name resolution log also includes: access time information; The process of obtaining the multiple second probe domain names based on the multiple domain name resolution logs includes: Based on the access time information in the multiple domain name resolution logs, determine the peak time period for domain name resolution; Based on the domain name resolution logs corresponding to the peak period, the multiple second probe domain names are determined.

3. The method according to claim 2, characterized in that, The domain name resolution log also includes: user internet access operation information; The determination of the plurality of second probe domain names based on the domain name resolution logs corresponding to the peak period includes: Based on the user internet access operation information in the domain name resolution logs corresponding to the peak period, determine the target domain name resolution logs corresponding to non-virtual users; Based on the target domain name resolution log, the plurality of second probe domain names are determined.

4. The method according to claim 1, characterized in that, The domain name resolution log also includes: the Internet Protocol address of the domain name resolution server corresponding to the domain name to be resolved; Send a second domain name resolution request to the domain name resolution server, including: Based on the Internet Protocol address of the domain name resolution server corresponding to the second probe domain name, send the second domain name resolution request to the domain name resolution server corresponding to the second probe domain name; After storing the network address corresponding to the second probe domain name in the database, the method further includes: The Internet Protocol address of the domain name resolution server corresponding to the second probe domain name is stored in the database.

5. The method according to claim 1, characterized in that, The database also includes the Internet Protocol address of the domain name resolution server corresponding to the first probed domain name; Sending a first domain name resolution request to the domain name resolution server at a preset detection frequency includes: At the preset detection frequency, the first domain name resolution request is sent to the domain name resolution server corresponding to the first detection domain name based on the Internet Protocol address of the domain name resolution server corresponding to the first detection domain name.

6. A DoH service identification device, characterized in that, include: The first detection module is used to send a first domain name resolution request to the domain name resolution server at a preset detection frequency. The first domain name resolution request is used to request domain name resolution service based on DoH for the first probe domain name. The first receiving module is configured to receive the first resolution result returned by the domain name resolution server for each first domain name resolution request, wherein the first resolution result includes whether the domain name resolution was successful. The update module is used to update the target network address in the database corresponding to the first probe domain name based on each first resolution result. The database includes multiple network addresses, each of which corresponds to a domain name resolution service based on DoH. The comparison module is used to compare the network address to be queried in the domain name resolution service type query request with the network address in the database in response to receiving the domain name resolution service type query request; The identification module is used to determine that the domain name resolution service in the domain name resolution service type query request is a DoH-based domain name resolution service in response to the existence of a network address in the database that is the same as the network address to be queried; The acquisition module is used to acquire multiple second probe domains; The second detection module is used to send a second domain name resolution request to the domain name resolution server for each second detection domain name. The second domain name resolution request is used to request domain name resolution service based on DoH for the second detection domain name. The second receiving module is used to receive the second resolution result fed back by the domain name resolution server in response to the second domain name resolution request; The first storage module is configured to store the network address corresponding to the second probe domain name into the database in response to the second resolution result indicating that the second probe domain name has been successfully resolved. The acquisition module includes: a first acquisition submodule, used to acquire multiple domain name resolution logs, each domain name resolution log including: a domain name to be resolved and the network address corresponding to the domain name to be resolved; and a second acquisition submodule, used to acquire the multiple second probe domain names based on the multiple domain name resolution logs.

7. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor is configured to execute a computer program stored in the memory, wherein when the computer program is executed, it implements the DoH service identification method according to any one of claims 1-5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the DoH service identification method according to any one of claims 1-5.

Images