A method and system for identifying and discovering authoritative servers of different types of domain names

Abstract

The present invention provides a method and system for identifying and discovering authoritative servers of different types of domain names, and relates to the technical field of data processing. The method comprises: obtaining a domain name set and its authoritative server set by obtaining network public domain name ranking data through a network request method; obtaining the authoritative server corresponding to each domain name by resolving the NS record of the domain name according to the domain name set, and forming an authoritative server set to be identified; constructing the association relationship between the authoritative servers and the resolved domain names according to the authoritative server set to be identified; analyzing the association relationship between the authoritative servers and the resolved domain names; establishing multiple determination strategies for identifying and discovering two different types of authoritative servers according to the association relationship information, and obtaining a third-party hosted authoritative server and a self-built authoritative server through the determination strategy. The present invention can effectively identify and discover two different types of authoritative servers, namely, self-built and third-party hosted.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to a method and system for identifying and discovering authoritative servers of different types of domain names. Background Art

[0002] The Domain Name System (DNS) is a key infrastructure supporting the Internet. It realizes the mapping between domain names and IP addresses, providing convenience for users to access the Internet. DNS is a distributed hierarchical system. Different levels of resolution servers are responsible for resolving domain name records at different levels. The authoritative server is the last layer of resolution servers. It plays a vital role in the domain name resolution process and is responsible for resolving all domain names in its authorized area into IP addresses or alias (CNAME) records.

[0003] At present, there are a large number of authoritative servers in the real network environment, and the quality of their resolution services varies, which directly affects the resolution efficiency and performance of domain names. To study the resolution service quality of authoritative servers, we first need to determine what type of authoritative servers they are. Authoritative servers can be divided into two types: self-built authoritative servers and third-party hosted authoritative servers. Currently, only a few authoritative servers of well-known third-party hosted resolution service providers are well known, but the types of most authoritative servers in other networks cannot be determined, and there is no effective identification and discovery method. Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide a method and system for identifying and discovering different types of domain name authoritative servers, which can effectively identify and discover two different types of authoritative servers: self-built and third-party hosted.

[0005] In order to solve the above technical problems, the technical solution of the present invention is as follows:

[0006] In a first aspect, a method for identifying and discovering different types of domain name authoritative servers is provided, the method comprising:

[0007] Obtaining the public domain name ranking data on the Internet through network requests to obtain a domain name set and its authoritative server set;

[0008] According to the domain name set, by parsing the NS record of the domain name, the authoritative server corresponding to each domain name is obtained to form a set of authoritative servers to be identified;

[0009] According to the set of authoritative servers to be identified, the association relationship between the authoritative servers and the resolved domain names is established;

[0010] Analyze the relationship between authoritative servers and resolved domain names;

[0011] According to the association relationship information, multiple determination strategies are respectively established for identifying and discovering two different types of authoritative servers, and the third-party hosted authoritative server and the self-built authoritative server are obtained through the determination strategies.

[0012] Furthermore, the public domain name ranking data of the network is obtained by network request to obtain a domain name set and its authoritative server set, including:

[0013] Parse and obtain the authoritative server set module to standardize the domain names in the domain name set;

[0014] For each domain name in the domain name set, query requests are iteratively sent to the root server and top-level domain server by using the DNS protocol;

[0015] Get the authorized NS record corresponding to the domain name and extract the authoritative server set from it;

[0016] The domain name and its corresponding authoritative server set data are stored in the database.

[0017] Furthermore, according to the set of authoritative servers to be identified, association relationships between authoritative servers and between authoritative servers and resolved domain names are constructed, including:

[0018] By analyzing the keyword similarity between authoritative server domain names, the association relationship between authoritative servers is established;

[0019] Clustering identifies the same similarity group to which the authoritative servers belong, and constructs a similarity set of authoritative servers;

[0020] By analyzing the keyword similarity and subject similarity between the authoritative server and the resolved domain name, as well as statistically analyzing the number of resolved domain names and the number of top-level domains covered, an association relationship between the authoritative server and the resolved domain name is established to construct corresponding multiple association sets.

[0021] Furthermore, the relationship between authoritative servers and resolved domain names includes the similarity between authoritative servers, the number of domain names and top-level domain ranges that authoritative servers are responsible for resolving, the consistency between authoritative servers and resolved domain name entities, and the similarity between authoritative servers and resolved domain names.

[0022] Furthermore, multiple determination strategies are established for identifying and discovering two different types of authoritative servers according to the association relationship information, including:

[0023] By setting two thresholds, namely the number of resolved domain names and the top-level range, authoritative servers with a value greater than the two thresholds are initially identified as third-party hosted authoritative servers.

[0024] Extract the primary domain name of the third-party hosted authoritative server and verify whether the corresponding service website exists.

[0025] Furthermore, multiple determination strategies are established for identifying and discovering two different types of authoritative servers according to the association relationship information, including:

[0026] By setting two thresholds, namely the number of resolved domain names and the top-level range, if the authoritative server is less than the two thresholds, it is initially identified as a self-built authoritative server;

[0027] Identify authoritative servers with the same primary domain name or a similar primary domain name as the resolved domain name as self-built authoritative servers.

[0028] Furthermore, after establishing the association relationship between the authoritative server and the resolved domain name to construct the corresponding multiple association sets, it also includes:

[0029] Store the constructed association relationship set in the database;

[0030] Relationships are indexed to find servers or domain names associated with a specific authoritative server.

[0031] In a second aspect, a system for identifying and discovering different types of domain name authoritative servers includes:

[0032] An acquisition module is used to obtain the public domain name ranking data on the Internet through a network request to obtain a domain name set and its authoritative server set; according to the domain name set, the authoritative server corresponding to each domain name is obtained by parsing the NS record of the domain name to form an authoritative server set to be identified;

[0033] The processing module is used to build the association relationship between authoritative servers and the resolved domain names according to the set of authoritative servers to be identified; analyze the association relationship between authoritative servers and the resolved domain names; establish multiple determination strategies for identifying and discovering two different types of authoritative servers according to the association relationship information, and obtain third-party hosted authoritative servers and self-built authoritative servers through the determination strategies.

[0034] According to a third aspect, a computing device includes:

[0035] one or more processors;

[0036] The storage device is used to store one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the method described.

[0037] In a fourth aspect, a computer-readable storage medium stores a program, and when the program is executed by a processor, the method described is implemented.

[0038] The above solution of the present invention includes at least the following beneficial effects:

[0039] The present invention first collects public domain name ranking data on the Internet to ensure that the acquired domain name set is representative and common, thereby improving the accuracy of subsequent identification steps. By parsing the NS record of the domain name, the authoritative server corresponding to each domain name is obtained, and an accurate set of authoritative servers to be identified is constructed, further laying a solid foundation for identifying different types of authoritative servers.

[0040] Constructing the association between authoritative servers and resolved domain names can comprehensively analyze the similarities between authoritative servers and the association between authoritative servers and their resolved domain names, thereby revealing the patterns and rules hidden behind the data.

[0041] The present invention establishes multiple determination strategies for identifying two different types of authoritative servers based on the association relationship information. These strategies are flexible and efficient, and can quickly and accurately identify third-party hosted authoritative servers and self-built authoritative servers. The design of this determination strategy not only improves the accuracy of identification, but also enhances the applicability and practicality of the method.

[0042] By accurately identifying different types of authoritative servers, network resource managers can better understand and grasp the distribution and configuration of network resources, thereby performing more effective resource management and optimization.

[0043] Accurately identifying different types of authoritative servers helps to timely discover and prevent network security risks. For example, for self-built authoritative servers, managers can take reinforcement measures in a timely manner due to potential security risks; for third-party hosted authoritative servers, they can have greater trust in their service quality and security. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 It is a flowchart of a method for identifying and discovering authoritative servers of different types of domain names provided by an embodiment of the present invention.

[0045] Figure 2 It is a schematic diagram of a system for identifying and discovering different types of domain name authoritative servers provided by an embodiment of the present invention.

[0046] Figure 3 It is a structural schematic diagram corresponding to Example 1 of the present invention. DETAILED DESCRIPTION

[0047] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0048] like Figure 1 As shown, an embodiment of the present invention provides a method for identifying and discovering different types of domain name authoritative servers, the method comprising the following steps:

[0049] Step 11, obtaining the public domain name ranking data through the network request method to obtain the domain name set and its authoritative server set;

[0050] Step 12, according to the domain name set, by parsing the NS record of the domain name, obtaining the authoritative server corresponding to each domain name, and forming an authoritative server set to be identified;

[0051] Step 13, building association relationships between authoritative servers and between authoritative servers and resolved domain names based on the set of authoritative servers to be identified;

[0052] Step 14, analyzing the relationship between authoritative servers and the resolved domain names;

[0053] Step 15, establishing multiple determination strategies for identifying and discovering two different types of authoritative servers according to the association relationship information, and obtaining the third-party hosted authoritative server and the self-built authoritative server through the determination strategies.

[0054] In the embodiment of the present invention, a domain name set is obtained from the public domain name ranking data on the network through step 11, which ensures that the processed data is currently active and popular domain names, thereby improving the accuracy of data analysis and identification in subsequent steps. Step 12 quickly obtains the authoritative server information of each domain name by resolving the NS record of the domain name, and constructs a set of authoritative servers to be identified. Steps 13 and 14 not only analyze the relationship between authoritative servers, but also deeply explore the association between authoritative servers and their resolved domain names. In step 15, multiple judgment strategies are established based on the association relationship information, which can flexibly respond to different types of authoritative server identification requirements. This flexibility enables the method to be more widely applied in various practical scenarios, improving its practicality and adaptability. By identifying different types of authoritative servers (such as third-party hosting and self-built), network managers can more clearly understand the distribution and configuration of network resources, thereby performing more refined resource management and optimization. Accurate classification of authoritative servers helps to discover potential security risks in a timely manner. For example, self-built authoritative servers may lack professional security protection measures, while third-party hosted authoritative servers may be subject to stricter supervision and protection. By identifying these server types, security protection measures can be strengthened in a targeted manner.

[0055] In another preferred embodiment of the present invention, the above step 11 may include:

[0056] Step 111, parsing and obtaining an authoritative server set module, and performing standardization processing on the domain names in the domain name set;

[0057] Step 112, for each domain name in the domain name set, iteratively sending a query request to the root server and the top-level domain server by using the DNS protocol;

[0058] Step 113, obtaining the authorized NS record corresponding to the domain name, and extracting the authoritative server set from it;

[0059] Step 114, storing the domain name and its corresponding authoritative server set data in a database.

[0060] In an embodiment of the present invention, step 111, standardizing the domain names in the domain name set can ensure the accuracy and consistency of the data, avoid parsing errors or repeated processing due to format differences, and thus improve the quality of subsequent data analysis and processing. Step 112, by using the DNS protocol to iteratively send query requests to the root server and the top-level domain server, this method can efficiently and accurately obtain the authoritative server information corresponding to the domain name, reduce redundancy and errors in the query process, and improve the efficiency and accuracy of data acquisition. Step 113, accurately extract the authoritative server set from the obtained authorized NS record. This step ensures the accuracy of the data and provides key basic data for subsequent data analysis and server type identification. Step 114, storing the domain name and its corresponding authoritative server set data in the database, not only realizes the persistent storage of data, but also facilitates subsequent data retrieval, update and analysis operations. In addition, database storage also provides data security backup and backtracking capabilities to ensure data integrity and security.

[0061] In another preferred embodiment of the present invention, the above step 13 may include:

[0062] Step 131, establishing associations between authoritative servers by analyzing keyword similarities between authoritative server domain names;

[0063] Step 132, clustering and identifying the same similarity group to which the authoritative servers belong, and constructing an authoritative server similarity set;

[0064] Step 133, by analyzing the keyword similarity and subject similarity between the authoritative server and the resolved domain name, as well as statistically analyzing the number of resolved domain names and the number of top-level domains covered, an association relationship between the authoritative server and the resolved domain name is established to construct corresponding multiple association sets.

[0065] In an embodiment of the present invention, step 131, by analyzing the keyword similarity between the authoritative server domain names to establish the association relationship between them, the mutual connection between the authoritative servers can be more deeply excavated. This similarity analysis helps to reveal those authoritative servers that may have some association in function, management or attribution, and provides rich clues for subsequent identification and classification. Step 132, clustering identifies the same similarity group to which the authoritative servers belong, and constructs an authoritative server similarity set. This step realizes the optimized organization and classification of data. Through clustering, authoritative servers with similar characteristics can be classified into one category, which simplifies the complexity of data processing and improves the efficiency and accuracy of subsequent determination strategies. Step 133, by comprehensively analyzing the keyword similarity and subject similarity between the authoritative server and the resolved domain name, as well as the number of resolved domain names and the number of top-level domains covered, a multi-dimensional association relationship is established. This method not only takes into account the direct connection between the domain name and the server, but also introduces a wider range of statistical and analytical dimensions, making the constructed relationship network more comprehensive and in-depth. The construction of this multi-dimensional relationship helps to more accurately identify and understand the characteristics and behavior patterns of different types of authoritative servers.

[0066] In a preferred embodiment of the present invention, the association relationship between authoritative servers and between authoritative servers and resolved domain names includes the similarity between authoritative servers, the number of domain names and top-level domain ranges that authoritative servers are responsible for resolving, the consistency between authoritative servers and resolved domain name subjects, and the similarity between authoritative servers and resolved domain names.

[0067] In the embodiment of the present invention, the similarity between authoritative servers is mainly reflected in their domain name composition, IP address distribution, management strategy and other aspects. For example, the same organization or entity may manage multiple authoritative servers, and these servers may have similar keywords or suffixes in the domain name, indicating that there is some kind of association or shared resources between them. An authoritative server may be responsible for resolving multiple domain names, and the number of these domain names and the top-level domain range involved (such as .com, .net, .org, etc.) are key indicators for evaluating its importance and influence. For example, an authoritative server responsible for resolving a large number of domain names may occupy a more important position in the network, and its stability and security have a greater impact on the entire network. There may be subject consistency between the authoritative server and the domain name it resolves, that is, the organization or entity represented by the domain name is the same or related to the manager or operator of the authoritative server. This consistency helps to confirm the authenticity and legitimacy of the domain name, because the authoritative server usually verifies and authorizes the domain name resolved by it. In addition to subject consistency, there may be similarities between the authoritative server and the domain name it resolves in keywords, semantics or visual design. This similarity may be due to brand strategy, market positioning or user-friendliness considerations, allowing users to more easily identify and remember domain names associated with specific authoritative servers.

[0068] In another preferred embodiment of the present invention, the above step 15 may include:

[0069] Step 151, by setting two thresholds of the number of resolved domain names and the top-level range, an authoritative server greater than the two thresholds is preliminarily identified as a third-party hosted authoritative server;

[0070] Step 152, extract the primary domain name of the third-party hosting authoritative server and verify whether the corresponding service website exists.

[0071] In an embodiment of the present invention, step 151, by setting two thresholds of the number of resolved domain names and the top-level domain range, those authoritative servers that may belong to third-party hosting can be quickly and preliminarily screened out. This method is based on the assumption that third-party hosted authoritative servers are usually responsible for a large number of domain name resolutions across multiple top-level domains, thereby achieving efficient preliminary identification. Step 152, after preliminary identification as a third-party hosted authoritative server, further extract its primary domain name and verify whether there is a corresponding service website. This step significantly improves the accuracy of identification. By verifying the existence of the service website, it can be confirmed that these authoritative servers are indeed operated by professional third-party hosting service providers, thereby reducing the possibility of misjudgment.

[0072] In another preferred embodiment of the present invention, the above step 15 may include:

[0073] Step 153, by setting two thresholds of the number of resolved domain names and the top-level range, if the authoritative server is less than the two thresholds, it is initially identified as a self-built authoritative server;

[0074] Step 154: Identify an authoritative server having the same primary domain name as the resolved domain name or a primary domain name similar to the resolved domain name as a self-built authoritative server.

[0075] In an embodiment of the present invention, step 153, by setting two thresholds of the number of resolved domain names and the top-level range, the authoritative servers can be accurately preliminarily classified. When the number of resolved domain names and the top-level domain range that the authoritative server is responsible for are less than the set threshold, these servers are more likely to be self-built authoritative servers. Step 154, an authoritative server with the same primary domain name or a similar primary domain name as the resolved domain name is identified as a self-built authoritative server. This step significantly enhances the accuracy of identification. Self-built authoritative servers are usually closely related to the domain names they resolve, such as using the same primary domain name or a similar domain name structure. Through this similarity identification, it is possible to more accurately determine which authoritative servers are self-built, thereby improving the accuracy and reliability of the overall identification.

[0076] In a preferred embodiment of the present invention, after the above step 133, the following steps are further included:

[0077] Step 1331, storing the constructed association relationship set in a database;

[0078] Step 1332, index the association relationship to find the server or domain name associated with the specific authoritative server.

[0079] In an embodiment of the present invention, step 1331 stores the constructed association relationship set in the database, thereby realizing persistent storage of data. This means that even if an interruption occurs during the processing or subsequent analysis is required, the established association relationship will not be lost and can be retrieved and accessed from the database at any time. In addition, as a centralized data storage point, the database can integrate multiple association relationship sets to facilitate global analysis and query. Step 1332 indexes the association relationship, which can significantly improve the efficiency of data retrieval and query. An index is a data structure that allows a database system to quickly locate data that matches specific query criteria. In this case, the index can be used to quickly find other servers or domain names associated with a specific authoritative server, thereby speeding up the analysis process.

[0080] like Figure 2 As shown, an embodiment of the present invention further provides a system 20 for identifying and discovering different types of domain name authoritative servers, including:

[0081] The acquisition module 21 is used to obtain the public domain name ranking data on the Internet through a network request to obtain a domain name set and its authoritative server set; according to the domain name set, the authoritative server corresponding to each domain name is obtained by parsing the NS record of the domain name to form an authoritative server set to be identified;

[0082] The processing module 22 is used to build the association relationship between the authoritative servers and the resolved domain names according to the set of authoritative servers to be identified; analyze the association relationship between the authoritative servers and the resolved domain names; establish multiple determination strategies for identifying and discovering two different types of authoritative servers according to the association relationship information, and obtain the third-party hosted authoritative servers and the self-built authoritative servers through the determination strategies.

[0083] Optionally, obtaining the public domain name ranking data on the Internet through a network request to obtain a domain name set and its authoritative server set, including:

[0084] Parse and obtain the authoritative server set module to standardize the domain names in the domain name set;

[0085] For each domain name in the domain name set, query requests are iteratively sent to the root server and top-level domain server by using the DNS protocol;

[0086] Get the authorized NS record corresponding to the domain name and extract the authoritative server set from it;

[0087] The domain name and its corresponding authoritative server set data are stored in the database.

[0088] Optionally, based on the set of authoritative servers to be identified, association relationships between authoritative servers and between authoritative servers and resolved domain names are established, including:

[0089] By analyzing the keyword similarity between authoritative server domain names, the association relationship between authoritative servers is established;

[0090] Clustering identifies the same similarity group to which the authoritative servers belong, and constructs a similarity set of authoritative servers;

[0091] By analyzing the keyword similarity and subject similarity between the authoritative server and the resolved domain name, as well as statistically analyzing the number of resolved domain names and the number of top-level domains covered, an association relationship between the authoritative server and the resolved domain name is established to construct corresponding multiple association sets.

[0092] Optionally, the relationship between the authoritative servers and the resolved domain names includes the similarity between the authoritative servers, the number of domain names and top-level domain ranges that the authoritative servers are responsible for resolving, the consistency between the authoritative servers and the resolved domain name subjects, and the similarity between the authoritative servers and the resolved domain names.

[0093] Optionally, multiple determination strategies are established for identifying and discovering two different types of authoritative servers according to the association relationship information, including:

[0094] By setting two thresholds, namely the number of resolved domain names and the top-level range, authoritative servers with a value greater than the two thresholds are initially identified as third-party hosted authoritative servers.

[0095] Extract the primary domain name of the third-party hosted authoritative server and verify whether the corresponding service website exists.

[0096] Optionally, multiple determination strategies are established for identifying and discovering two different types of authoritative servers according to the association relationship information, including:

[0097] By setting two thresholds, namely the number of resolved domain names and the top-level range, if the authoritative server is less than the two thresholds, it is initially identified as a self-built authoritative server;

[0098] Identify authoritative servers with the same primary domain name or a similar primary domain name as the resolved domain name as self-built authoritative servers.

[0099] Optionally, after establishing the association relationship between the authoritative server and the resolved domain name to construct the corresponding multiple association sets, the method further includes:

[0100] Store the constructed association relationship set in the database;

[0101] Relationships are indexed to find servers or domain names associated with a specific authoritative server.

[0102] Example 1

[0103] like Figure 3 As shown, a method for identifying and discovering different types of domain name authoritative servers includes:

[0104] Step 1: Domain name set, identify the domain name set based on which the authoritative server is found. This domain name set and the domain names that users care about and have a large number of visits in the real network are selected, such as Alexa ranking and Cisco Umbrella ranking domain names;

[0105] Step 2, parsing and obtaining the authoritative server set module, first of all, the domain names in the domain name set need to be standardized to ensure that the domain names to be resolved are all registered domain names; then, for each domain name in the domain name set, query requests are iteratively sent to the root server and the top-level domain server by using the DNS protocol to obtain the authorized NS record corresponding to the domain name, and extract the authoritative server set from it; finally, the domain name and its corresponding authoritative server set data are stored in the database for subsequent use;

[0106] Step 3, construct the association relationship module between authoritative servers and resolved domain names. First, by analyzing the keyword similarity between the authoritative server domain names, the association relationship between the authoritative servers is established, and then clustering is used to identify which servers belong to the same similarity group to construct an authoritative server similarity set; secondly, by analyzing the keyword similarity and subject similarity between the authoritative server and the resolved domain name, as well as statistically analyzing the number of resolved domain names and the number of top-level domains covered, the association relationship between the authoritative server and the resolved domain name is established, and multiple corresponding association sets are constructed; finally, the constructed association relationship set is stored in the database, and a reasonable dictionary data structure is designed to support efficient query, and the association relationship is indexed so that other servers or domain names associated with a specific authoritative server can be quickly found. Therefore, this module specifically includes four sub-modules: a sub-module for analyzing the similarity between authoritative servers, a sub-module for obtaining the number of domain names authorized to be resolved by the authoritative server, a sub-module for analyzing whether the authoritative server and the resolved domain name subject are consistent, and a sub-module for analyzing the similarity between the authoritative server and the resolved domain name:

[0107] Step 31, the authoritative server mutual similarity analysis submodule aggregates authoritative servers with the same or similar primary domain names through keyword similarity matching;

[0108] Step 32, obtaining the domain name range and number submodule authorized by the authoritative server to resolve, counting the number of domain names each authoritative server is responsible for resolving and the number of top-level domains corresponding to the domain names;

[0109] Step 33, whether the authoritative server and the resolved domain name subject are consistent with each other, through the domain name WHOIS, IPWHOIS, domain name ICP filing, website content and other information, to determine whether the authoritative server and the resolved domain name belong to the same subject;

[0110] Step 34, a similarity analysis submodule between the authoritative server and the resolved domain name, analyzing whether the authoritative server and its resolved domain name have the same or similar primary domain name through keyword matching;

[0111] Step 4: The third-party hosted authoritative server identification and discovery module identifies the hosted authoritative server from the authoritative server set based on the following three different discovery strategies:

[0112] Step 41, the threshold determination strategy for the number of resolved domain names. The basis of this strategy is that the third-party hosting service provider is for a large number of users, so the number of domain names resolved by its authoritative server is generally large, and the top-level domain range it covers is also large. Therefore, this strategy sets two thresholds for the number of resolved domain names and the top-level range. The authoritative server with more than the two thresholds is initially identified as a third-party hosting authoritative server;

[0113] Step 42, domain name resolution service website verification strategy, extract the primary domain name of the hosting authoritative server identified in 4.1, and verify whether the corresponding service website exists (if it is a hosting server, there will generally be a website with the primary domain name as the address, which is convenient for providing domain name registration and resolution services to users). Further verification is used to improve the recognition accuracy;

[0114] Step 43, similar aggregation strategy of authoritative servers. In order to achieve load balancing of resolution traffic and improve resolution efficiency, third-party hosting service providers generally configure multiple authoritative resolution servers with the same or similar primary domain names. Therefore, other servers in the same aggregation group as the servers identified in steps 41 and 42 can also be determined as third-party hosting authoritative servers.

[0115] Step 5: The self-built authoritative server identification and discovery module identifies the self-built authoritative server from the authoritative server set based on the following three different discovery strategies:

[0116] Step 51, the threshold determination strategy for the number of resolved domain names. Since the self-built authoritative server is only responsible for resolving a few domain names within the company, and these domain names generally have the same primary domain name, only one or a few top-level domains are involved. Therefore, this strategy sets two thresholds for the number of resolved domain names and the top-level range. If the authoritative server is less than the two thresholds, it is initially identified as a self-built authoritative server.

[0117] Step 52, primary domain name similarity strategy, based on the fact that the self-built authoritative server and its resolved domain name usually have the same primary domain name or a similar primary domain name, this strategy identifies the authoritative server with the same primary domain name or a similar primary domain name as the resolved domain name as the self-built authoritative server;

[0118] Step 53, subject consistency strategy, for the authoritative server identified by the policies of step 51 and step 52, further identify whether it is a self-built authoritative server by verifying whether its subject is consistent with the subject of the domain name, thereby improving the accuracy of identification and discovery.

[0119] The present invention will be further described below in conjunction with embodiments.

[0120] The main steps to identify and discover the two different types of authoritative servers, third-party hosted and self-built, are as follows:

[0121] 1. The steps to obtain the domain name collection are as follows:

[0122] Collect domain names that are frequently used and have a large number of visits by users. You can use network requests to obtain public domain name ranking data on the Internet, such as Alex's top million domain name data or Cisco Umbrella's top million domain name data.

[0123] 2. The steps to obtain the authoritative server set are as follows:

[0124] Based on the domain name set, the authoritative server corresponding to each domain name is obtained by parsing the NS record of the domain name to form the authoritative server set to be identified. In this step, it is necessary to remove the host name if there is a fully qualified domain name (FQDN) in the domain name set, and request the NS record corresponding to the registered domain name, such as www.freedesktop.org, and the registered domain name is freedesktop.org.

[0125] 3. Build the relationship between authoritative servers and resolved domain names. The steps are as follows:

[0126] Step 1, traverse the authoritative server set, and aggregate the authoritative servers with the same or similar primary domain names through keyword similarity matching. The aggregated set is recorded as: setauth_same. For example, ns1.xserver.jp / ns2.xserver.jp / ns3.xserver.jp / ns4.xserver.jp / ns5.xserver.jp, the five authoritative servers have the same primary domain name (xserver.jp), so they are aggregated into one group; similarly, ns1-08.azure-dns.com / ns1-08.azure-dns.net / ns1-08.azure-dns.org / ns1-08.azure-dns.info, the four authoritative servers have similar domain name structures (ns1-08.azure-dns.*) except for the top-level domains, so they are aggregated into one group.

[0127] Step 2: Count the number of domain names that each authoritative server is responsible for resolving and the number of top-level domains corresponding to the domain names (to identify the scope of top-level domains covered), and construct the dictionary dictdomain_tld_num;

[0128] Step 3: Analyze whether the authoritative server and its resolved domain name have the same or similar primary domain name through keyword matching, and construct the dictionary dictprimary_domain_consistent. For example, the authoritative server ns1.zoznam.sk and the resolved domain name zoznam.sk have the same primary domain name zoznam.sk; the authoritative server ns1.bancocuscatlan.com.sv and the resolved domain name bancocuscatlan.com have similar primary domain names.

[0129] Step 4, through the domain name WHOIS, IP WHOIS, ICP record, website content and other information, obtain the subject-related information of the authoritative server and its resolved domain name, and determine whether the two subjects are consistent, and construct the dictionary dictsubject_consistent accordingly. For example, the authoritative server ns1.jjworld.net.cn and its resolved domain name jj.cn, both of which have ICP record subject units: Jingji World (Beijing) Network Technology Co., Ltd., so it can be determined that the two subjects are consistent.

[0130] 4. Traverse the authoritative server set and identify the third-party hosted authoritative server. The steps are as follows:

[0131] Step 1, first, set two thresholds n1 and n2 for the number of resolved domain names and the top-level domain range, and then traverse the dictionary dictdomain_tld_num. The servers whose number of resolved domain names and top-level ranges are greater than the two thresholds are initially identified as third-party hosting authoritative servers. The size of the two thresholds can be changed dynamically. The larger the two values, the higher the accuracy of the initial identification, but they should not be too large. If they are too large, some hosting servers will be passed and cannot be identified. Based on statistical experience, n1 and n2 can be set to 20 and 5 respectively.

[0132] Step 2, traverse the servers identified in step 1, extract their primary domain names, and determine whether the authoritative server has a corresponding service site by requesting the domain name website information (if it is a hosting server, there will generally be a website with the primary domain name as the address, which is convenient for providing domain name registration and resolution services to users). For example, Alibaba Cloud's authoritative server dns10.hichina.com has a service website www.hichina.com. Keep the servers with existing sites and filter out those that do not exist. Further verification through this step can improve the recognition accuracy.

[0133] Step 3, combine the aggregation results of the authoritative servers in the association relationship to expand the identification results. In order to achieve load balancing of resolution traffic and improve resolution efficiency, third-party hosting service providers generally configure multiple authoritative resolution servers with the same or similar primary domain names. Therefore, the servers and aggregation set setauth_same identified in step 2, and other authoritative servers in the same aggregation group as the identified servers are also identified as third-party hosted authoritative servers. For example, servers expirens3.hichina.com and dns10.hichina.com belong to the same aggregation group. dns10.hichina.com is identified as a third-party hosted authoritative server through steps 1 and 2. However, due to the small number of resolved domain names, expirens3.hichina.com has been filtered out through step 1, but it is in the same aggregation group as the identified authoritative server dns10.hichina.com, so it can also be identified as a third-party hosted authoritative server.

[0134] 5. Traverse the authoritative server set and identify the self-built authoritative server. The steps are as follows:

[0135] Step 1, in contrast to identifying third-party hosted authoritative servers, first traverse the dictionary dictdomain_tld_num, filter out authoritative servers whose number of resolved domain names and top-level domain range statistics are both less than thresholds n1 and n2, and identify them as self-built authoritative servers.

[0136] Step 2: Based on the fact that the self-built authoritative server and its resolved domain name usually have the same primary domain name or similar primary domain name, traverse the dictionary dictprimary_domain_consistent to analyze whether the authoritative server and all the domain names it is responsible for resolving have the same primary domain name or similar domain names. If so, it is identified as a self-built authoritative server. For example, the authoritative server dns1.hitwh.edu.cn and its resolved domain name www.dns2.hitwh.edu.cn / lib.hitwh.edu.cn / job.hitwh.edu.cn / jwc.hi twh.edu.cn, etc., have the same primary domain name hitwh.edu.cn, so the authoritative server dns1.hitwh.edu.cn is identified as a self-built authoritative server.

[0137] Step 3: traverse the self-built authoritative servers identified in step 1 and step 2, and check whether the authoritative server and all its resolved domain names belong to the same subject by comparing the dictionary dictsubject_consisten. If they belong to the same subject, they are retained, otherwise they are deleted from the set of identified self-built authoritative servers.

[0138] It should be noted that the system is a system corresponding to the above method, and all implementation methods in the above method embodiment are applicable to this embodiment and can achieve the same technical effect.

[0139] The embodiment of the present invention further provides a computing device, comprising: a processor, a memory storing a computer program, wherein when the computer program is executed by the processor, the method described above is executed. All implementations in the above method embodiment are applicable to this embodiment and can achieve the same technical effect.

[0140] The embodiment of the present invention also provides a computer-readable storage medium storing instructions, which, when executed on a computer, enable the computer to execute the method described above. All implementations in the above method embodiment are applicable to this embodiment and can achieve the same technical effect.

[0141] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0142] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0143] In the embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0144] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0145] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0146] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, ROM, RAM, magnetic disks, or optical disks.

[0147] In addition, it should be noted that in the apparatus and method of the present invention, it is obvious that each component or each step can be decomposed and / or recombined. These decompositions and / or recombinations should be regarded as equivalent schemes of the present invention. Moreover, the steps of performing the above-mentioned series of processing can naturally be performed in chronological order according to the order of description, but it is not necessary to perform them in chronological order, and some steps can be performed in parallel or independently of each other. For those of ordinary skill in the art, it is understood that all or any steps or components of the method and apparatus of the present invention can be implemented in any computing device (including processors, storage media, etc.) or a network of computing devices in hardware, firmware, software or a combination thereof, which can be achieved by those of ordinary skill in the art using basic programming skills after reading the description of the present invention.

[0148] Therefore, the purpose of the present invention can also be achieved by running a program or a group of programs on any computing device. The computing device can be a well-known general device. Therefore, the purpose of the present invention can also be achieved by simply providing a program product containing a program code that implements the method or device. That is to say, such a program product also constitutes the present invention, and the storage medium storing such a program product also constitutes the present invention. Obviously, the storage medium can be any well-known storage medium or any storage medium developed in the future. It should also be pointed out that in the device and method of the present invention, it is obvious that each component or each step can be decomposed and / or recombined. These decompositions and / or recombinations should be regarded as equivalent schemes of the present invention. In addition, the steps of performing the above-mentioned series of processing can naturally be performed in chronological order according to the order of description, but it is not necessary to perform them in chronological order. Some steps can be performed in parallel or independently of each other.

[0149] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for identifying and discovering different types of domain name authoritative servers, characterized in that: The method comprises: Obtaining the public domain name ranking data on the Internet through network requests to obtain a domain name set and its authoritative server set; According to the domain name set, by parsing the NS record of the domain name, the authoritative server corresponding to each domain name is obtained to form a set of authoritative servers to be identified; According to the set of authoritative servers to be identified, the association relationship between the authoritative servers and the resolved domain names is established; Analyze the relationship between authoritative servers and resolved domain names; According to the association relationship information, multiple determination strategies are respectively established for identifying and discovering two different types of authoritative servers, and the third-party hosted authoritative server and the self-built authoritative server are obtained through the determination strategies; Based on the association information, multiple determination strategies are established for identifying and discovering two different types of authoritative servers, including: By setting two thresholds, namely the number of resolved domain names and the top-level range, authoritative servers with a value greater than the two thresholds are initially identified as third-party hosted authoritative servers. Extract the primary domain name of the third-party hosting authoritative server and verify whether the corresponding service website exists; By setting two thresholds, namely the number of resolved domain names and the top-level range, if the authoritative server is less than the two thresholds, it is initially identified as a self-built authoritative server; Identify authoritative servers with the same primary domain name or a similar primary domain name as the resolved domain name as self-built authoritative servers.

2. The method for identifying and discovering different types of domain name authoritative servers according to claim 1, characterized in that: Obtain the public domain name ranking data through network request to obtain the domain name set and its authoritative server set, including: Parse and obtain the authoritative server set module to standardize the domain names in the domain name set; For each domain name in the domain name set, query requests are iteratively sent to the root server and top-level domain server by using the DNS protocol; Get the authorized NS record corresponding to the domain name and extract the authoritative server set from it; The domain name and its corresponding authoritative server set data are stored in the database.

3. The method for identifying and discovering different types of domain name authoritative servers according to claim 2, characterized in that: According to the set of authoritative servers to be identified, the association relationship between authoritative servers and the resolved domain names is established, including: By analyzing the keyword similarity between authoritative server domain names, the association relationship between authoritative servers is established; Clustering identifies the same similarity group to which the authoritative servers belong, and constructs a similarity set of authoritative servers; By analyzing the keyword similarity and subject similarity between the authoritative server and the resolved domain name, as well as statistically analyzing the number of resolved domain names and the number of top-level domains covered, an association relationship between the authoritative server and the resolved domain name is established to construct corresponding multiple association sets.

4. The method for identifying and discovering different types of domain name authoritative servers according to claim 3, characterized in that: The relationship between authoritative servers and resolved domain names includes the similarity between authoritative servers, the number of domain names and top-level domain ranges that authoritative servers are responsible for resolving, the consistency between authoritative servers and resolved domain name entities, and the similarity between authoritative servers and resolved domain names.

5. The method for identifying and discovering different types of domain name authoritative servers according to claim 4, characterized in that: After establishing the association relationship between the authoritative server and the resolved domain name to construct the corresponding multiple association sets, it also includes: Store the constructed association relationship set in the database; Relationships are indexed to find servers or domain names associated with a specific authoritative server.

6. A system for identifying and discovering different types of domain name authoritative servers, characterized in that: include: An acquisition module is used to obtain public domain name ranking data on the Internet through network requests to obtain a domain name set and its authoritative server set; According to the domain name set, by parsing the NS record of the domain name, the authoritative server corresponding to each domain name is obtained to form a set of authoritative servers to be identified; The processing module is used to construct the association relationship between the authoritative servers and the resolved domain names according to the set of authoritative servers to be identified; analyze the association relationship between the authoritative servers and the resolved domain names; establish multiple determination strategies for identifying and discovering two different types of authoritative servers according to the association relationship information, and obtain the third-party hosted authoritative server and the self-built authoritative server through the determination strategy; Based on the association information, multiple determination strategies are established for identifying and discovering two different types of authoritative servers, including: By setting two thresholds, namely the number of resolved domain names and the top-level range, authoritative servers with a value greater than the two thresholds are initially identified as third-party hosted authoritative servers. Extract the primary domain name of the third-party hosting authoritative server and verify whether the corresponding service website exists; By setting two thresholds, namely the number of resolved domain names and the top-level range, if the authoritative server is less than the two thresholds, it is initially identified as a self-built authoritative server; Identify authoritative servers with the same primary domain name or a similar primary domain name as the resolved domain name as self-built authoritative servers.

7. A computing device, characterized in that include: one or more processors; A storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the method as claimed in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a program, which implements the method according to any one of claims 1 to 5 when executed by a processor.

Images