A method and system for evaluating the user scale of a recursive resolver from the outside

Abstract

The present invention provides a method and system for externally evaluating the user scale of a recursive resolver, relating to the field of data processing technology. The method comprises: measuring and analyzing attribute characteristics of recursive resolvers of different user scale levels according to the divided user volume levels to obtain measurement results; analyzing the attribute characteristics of the recursive resolvers of different user levels according to the measurement results to obtain the response delay and the number of responding IP addresses of the recursive resolver; obtaining the response delay, the number of responding IP addresses, and their configuration attributes of the recursive resolver through an attribute configuration module; obtaining and analyzing passive data; and constructing a multi-attribute evaluation model based on the response delay, the number of responding IP addresses, the configuration attributes, and the passive data of the recursive resolver to evaluate the user scale level of the DNS recursive resolver. The present invention can evaluate the user scale of a recursive resolver from multi-dimensional data.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a method and system for evaluating the user scale of a recursive resolver from the outside. Background Art

[0002] The Domain Name System (DNS) is the cornerstone of the Internet and one of its most important infrastructures. DNS recursive resolvers play an important role in the DNS by caching resolved domain name records to improve query performance and reduce the load on DNS servers. Furthermore, recursive resolvers can handle various types of DNS queries, such as A records, AAAA records, and CNAME records, and support related DNS protocol features, such as DNS Security Extensions (DNSSEC). Assessing the user scale of recursive resolvers helps regulators understand the service status of DNS recursive servers and further optimize network resource allocation to provide more efficient and reliable domain name resolution services. It also provides researchers with important data source references.

[0003] Most research on measuring the user base of recursive resolvers focuses on methods based on passive DNS traffic, using supervised or unsupervised learning methods to generate user fingerprints from DNS requests and use these fingerprints to identify users. However, these methods suffer from the difficulty of obtaining recursive resolver traffic data, resulting in inaccurate and incomplete results. Furthermore, they can only measure the user base of individual recursive resolvers. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide a method and system for evaluating the user scale of a recursive resolver from the outside, combining active data and passive data to evaluate the user scale of a recursive resolver from multi-dimensional data.

[0005] In order to solve the above technical problems, the technical solutions of the present invention are as follows:

[0006] In a first aspect, a method for evaluating the user scale of a recursive resolver from the outside is provided, the method comprising:

[0007] Analyze the local user volume of the known recursive resolver through the regional user request quantity module, and divide the local user volume into levels to obtain the divided user volume levels;

[0008] According to the user volume levels, the attribute characteristics of the recursive resolvers at different user scale levels are measured and analyzed to obtain measurement results;

[0009] Analyze the attribute characteristics of recursive resolvers at different user levels based on the measurement results to obtain the response delay and number of responding IP addresses of the recursive resolvers;

[0010] Obtain the response delay, number of response IP addresses, and configuration properties of the recursive resolver through the property configuration module;

[0011] Acquire and analyze passive data;

[0012] Based on the response delay, number of responding IP addresses, configuration attributes, and passive data of the recursive resolver, a multi-attribute evaluation model is constructed to evaluate the user scale level of the DNS recursive resolver.

[0013] Furthermore, the attribute characteristics include response delay, number of responding IPs, PTR record status, software version, and support for EDNS, DoH, and DoT encryption protocols.

[0014] Furthermore, passive data includes DNS public data sources and DNS service provider information.

[0015] Furthermore, the response latency of the recursive resolver is obtained, including:

[0016] Use the domain name resolution module to request the recursive resolver to query the A record of the domain name;

[0017] Get the time T1 from when the user sends the domain name request to when the user receives the response packet;

[0018] Use the ping command to calculate the network time T2 consumed by the user to the DNS recursive server;

[0019] Subtract the network consumption time T2 from the response packet time T1 to obtain the response delay of the recursive server.

[0020] Furthermore, the number of IP addresses that responded to the recursive resolver is obtained, including:

[0021] Using the domain name resolution module, multiple detection points request the recursive resolver to query the A record of the domain name and analyze the response message returned by the recursive resolver;

[0022] Extract source IP information from the response message by capturing the packet;

[0023] Record the number of different IP addresses, that is, the number of response IP addresses of the DNS recursive resolver.

[0024] Furthermore, passive data is obtained and analyzed, including:

[0025] Obtain recursive DNS information based on the passive data module;

[0026] From the obtained recursive DNS information, analyze whether each DNS recursive resolver is a public DNS data source;

[0027] From the obtained recursive DNS information, analyze whether the service provider of the DNS recursive resolver can be obtained.

[0028] Furthermore, based on the response latency, number of responding IP addresses, configuration attributes, and passive data of the recursive resolver, a multi-attribute evaluation model is constructed to assess the user scale level of the DNS recursive resolver, including:

[0029] Obtain the response latency, number of responding IP addresses, configuration properties, DNS public data sources, and DNS service provider information of the recursive resolver;

[0030] From the perspective of domain name resolution, the response delay and the number of responding IP addresses of the recursive resolver are normalized, and the entropy weight method in the objective weighting method is used to evaluate the domain name resolution performance of the recursive resolver.

[0031] From the perspective of server attribute configuration, the recursive resolver's PTR record, EDNS protocol, software version, and vulnerabilities are normalized;

[0032] From the passive data perspective, we normalize DNS public data sources and DNS service providers, and use the CRITIC method in the objective weighting method to evaluate the passive data of recursive resolvers.

[0033] The subjective weights were determined using the analytic hierarchy process based on domain name resolution, attribute configuration, and passive data, the objective weights were determined using the CRITIC method, and the comprehensive weights were determined using the linear weighting method to construct a multi-attribute evaluation model.

[0034] Calculate the user scale of each DNS recursive resolver based on a multi-attribute evaluation model;

[0035] The user scale of the DNS recursive resolver is divided into levels to obtain the user scale level of each recursive resolver.

[0036] In a second aspect, a system for evaluating the user scale of a recursive resolver from the outside is provided, comprising:

[0037] An acquisition module is used to analyze the local user volume of a known recursive resolver through a regional user request quantity module, and divide the local user volume into levels to obtain divided user volume levels; based on the divided user volume levels, measure and analyze the attribute characteristics of recursive resolvers of different user scale levels to obtain measurement results;

[0038] The processing module is used to analyze the attribute characteristics of recursive resolvers of different user levels based on the measurement results to obtain the response delay and number of response IP addresses of the recursive resolver; obtain the response delay, number of response IP addresses and their configuration attributes of the recursive resolver through the attribute configuration module; obtain and analyze passive data; and construct a multi-attribute evaluation model based on the response delay, number of response IP addresses, configuration attributes and passive data of the recursive resolver to evaluate the user scale level of the DNS recursive resolver.

[0039] According to a third aspect, a computing device includes:

[0040] one or more processors;

[0041] The storage device is used to store one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors implement the method.

[0042] In a fourth aspect, a computer-readable storage medium stores a program, which implements the method when executed by a processor.

[0043] The above solution of the present invention includes at least the following beneficial effects:

[0044] Based on multi-dimensional data such as domain name resolution, server attribute configuration, and passive data, a more comprehensive assessment of the user scale of the DNS recursive resolver can be made through multi-faceted data, which helps regulators understand the service status of the recursive resolver and further optimize network resource allocation. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 It is a flowchart of a method for evaluating the user scale of a recursive resolver from the outside provided by an embodiment of the present invention.

[0046] Figure 2 1 is a schematic diagram of a system for evaluating the user scale of a recursive resolver from the outside, provided by an embodiment of the present invention.

[0047] Figure 3 It is a structural diagram corresponding to Example 1 of the present invention. DETAILED DESCRIPTION

[0048] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0049] like Figure 1 As shown, an embodiment of the present invention proposes a method for evaluating the user scale of a recursive resolver from the outside, the method comprising the following steps:

[0050] Step 11: Analyze the local user volume of the known recursive resolver through the regional user request volume module, and divide the local user volume into levels to obtain divided user volume levels;

[0051] Step 12: measuring and analyzing the attribute characteristics of the recursive resolvers of different user scale levels according to the divided user scale levels to obtain measurement results;

[0052] Step 13: Analyze the attribute characteristics of the recursive resolvers of different user levels based on the measurement results to obtain the response delay and the number of response IP addresses of the recursive resolvers;

[0053] Step 14: Obtain the response delay, number of response IP addresses, and configuration properties of the recursive resolver through the property configuration module;

[0054] Step 15, acquiring and analyzing passive data;

[0055] Step 16: Based on the response delay, number of responding IP addresses, configuration attributes, and passive data of the recursive resolver, a multi-attribute evaluation model is constructed to evaluate the user scale level of the DNS recursive resolver.

[0056] In an embodiment of the present invention, step 11 can accurately understand the number of users currently served by the recursive resolver and divide them into different levels. Step 12, by measuring the attribute characteristics of recursive resolvers of different user scale levels, the performance of the resolver under different loads can be deeply understood. This helps to discover potential performance bottlenecks and optimization points. Step 13, these two indicators are key parameters for evaluating the performance of the recursive resolver. The response delay reflects the processing speed of the resolver, while the number of responding IPs reflects the concurrent processing capability of the resolver. Obtaining this data helps to accurately evaluate the performance level of the resolver. Step 14, using the attribute configuration module to analyze the response delay and the number of responding IPs, the data can be processed and analyzed more efficiently and accurately. This helps to detect abnormal situations in a timely manner and make corresponding adjustments and optimizations. Step 15, passive data usually comes from the actual network environment and user behavior, and therefore has high authenticity and reference value. By analyzing these passive data, the performance and problems of the recursive resolver in actual use can be more comprehensively understood. Step 16 comprehensively considers the recursive resolver's response latency, number of responding IP addresses, passive data, and a multi-attribute evaluation model to more scientifically and comprehensively assess the user scale of the DNS recursive resolver. This helps provide network service providers with accurate user scale information, enabling them to more effectively allocate resources and optimize services.

[0057] In a preferred embodiment of the present invention, the attribute characteristics include response delay, number of responding IPs, PTR record status, software version, and support for EDNS, DoH, and DoT encryption protocols; passive data includes DNS public data source and DNS service provider information.

[0058] In an embodiment of the present invention, response latency is an important indicator for measuring the performance of a recursive resolver. A lower response latency means that the resolver can respond to user requests faster, thereby providing a better user experience. By analyzing the number of responding IPs, the resolver's ability to handle concurrent requests can be understood. A higher number of responding IPs indicates that the resolver can support more users accessing simultaneously, reflecting its good scalability and service capabilities. The validity of the PTR record (reverse DNS lookup) can reflect the configuration integrity and data consistency of the resolver. Correct PTR records help improve network diagnosis and security, but may also affect the credibility of certain network services (such as mail servers). Understanding the software version of the recursive resolver helps to evaluate its security and functionality. Updated software versions usually contain the latest security patches and feature enhancements, which are crucial for protecting user data and providing stable services. The support for encryption protocols reflects the recursive resolver's ability to protect user privacy and improve data transmission security. Using DNS public data sources, you can obtain extensive information about the usage and performance of recursive resolvers. These data usually come from multiple network environments and user groups, and therefore have high representativeness and reference value. Understanding the DNS service provider's operations, service quality, and user feedback provides another perspective for evaluating the user base and service quality of recursive resolvers. This information helps identify potential service issues and provide users with more reliable network services.

[0059] In a preferred embodiment of the present invention, the above step 13 may include:

[0060] Step 131: Utilize the domain name resolution module to request the recursive resolver to query the A record of the domain name;

[0061] Step 132: Obtain the time T1 from when the user sends the domain name request to when the user receives the response packet;

[0062] Step 133, using the ping command to calculate the network consumption time T2 from the user to the DNS recursive server;

[0063] Step 134: Subtract the network consumption time T2 from the response packet time T1 to obtain the response delay of the recursive server.

[0064] In an embodiment of the present invention, step 131, sending a standard DNS query request through the domain name resolution module can ensure the accuracy and consistency of the measurement. Requesting an A record is a common DNS query type used to resolve a domain name to a corresponding IPv4 address, which helps to evaluate the performance of the recursive resolver when processing typical queries. Step 132, this time T1 represents the total time from the user initiating the query to receiving the resolution response, which includes the network transmission time and the processing time of the recursive resolver. Step 133, measuring the network delay from the user to the DNS recursive server through the ping command, a relatively accurate network transmission time T2 can be obtained. This time is mainly used to eliminate the impact of network transmission factors on the response delay of the recursive resolver in subsequent calculations. Step 134, by calculating T1 minus T2, a purer response delay of the recursive resolver can be obtained. This delay reflects the time required for the recursive resolver to perform internal processing and return the result after receiving the query request.

[0065] In a preferred embodiment of the present invention, the above step 13 may include:

[0066] Step 131: Using the domain name resolution module, multiple detection points request the recursive resolver to query the A record of the domain name and analyze the response message returned by the recursive resolver;

[0067] Step 132, extracting source IP information from the response message by capturing the packet;

[0068] Step 133: Record the number of different IP addresses, that is, the number of response IP addresses of the DNS recursive resolver.

[0069] In this embodiment of the present invention, step 131, by using multiple detection points to simultaneously initiate query requests, it is possible to simulate the situation of concurrent user access in an actual network environment. Analyzing the returned response messages helps to understand the behavior and performance of the recursive resolver when processing these concurrent requests. Step 132, packet capture technology allows us to capture the original data packets in network transmission, so that we can accurately extract the source IP information in the response message. Step 133, by recording and analyzing the number of different IPs, we can obtain the IP range involved in the recursive resolver's concurrent processing process.

[0070] In a preferred embodiment of the present invention, the above step 15 may include:

[0071] Step 151, obtaining recursive DNS information based on the passive data module;

[0072] Step 152: Analyze each DNS recursive resolver from the obtained recursive DNS information to determine whether it is a DNS public data source;

[0073] Step 153: Analyze whether the service provider of the DNS recursive resolver can be obtained from the obtained recursive DNS information.

[0074] In an embodiment of the present invention, in step 151, a large amount of recursive DNS information can be efficiently collected through the passive data module. This information is naturally generated in the actual network environment and therefore has high authenticity and practical value. In step 152, by analyzing the obtained recursive DNS information, it is possible to identify which recursive resolvers are public data sources. Public data sources usually mean that the data can be accessed and used by the public. Understanding this helps to evaluate the data transparency and credibility of the recursive resolver. In step 153, by analyzing the recursive DNS information, the service provider behind the recursive resolver is identified. Understanding the information of the service provider helps to evaluate the service quality, reliability and security of the recursive resolver.

[0075] In a preferred embodiment of the present invention, the above step 16 may include:

[0076] Step 161: Obtain the response delay, number of responding IP addresses, configuration attributes, DNS public data source, and DNS service provider information of the recursive resolver;

[0077] Step 162: From the perspective of domain name resolution, the response delay and the number of responding IP addresses of the recursive resolver are normalized, and the domain name resolution performance of the recursive resolver is evaluated using the entropy weight method in the objective weighting method.

[0078] Step 163 , normalizing the recursive resolver's PTR record, EDNS protocol, software version, and vulnerabilities from the perspective of server attribute configuration;

[0079] Step 164, from the passive data perspective, normalize the DNS public data source and DNS service provider, and use the CRITIC method in the objective weighting method to evaluate the passive data of the recursive resolver;

[0080] Step 165 , determining subjective weights using the analytic hierarchy process based on domain name resolution, attribute configuration, and passive data, determining objective weights using the CRITIC method, and determining comprehensive weights using the linear weighting method to construct a multi-attribute evaluation model;

[0081] Step 166: Calculate the user scale of each DNS recursive resolver based on the multi-attribute evaluation model;

[0082] Step 167: Classify the user scale of the DNS recursive resolver into levels to obtain the user scale level of each recursive resolver.

[0083] In an embodiment of the present invention, step 161 is the data collection stage, which ensures that all relevant evaluation indicators are taken into consideration. Step 162, by normalizing the response delay and the number of responding IPs and evaluating them using the entropy weight method, the performance of the recursive resolver in domain name resolution can be objectively reflected, which helps to identify recursive resolvers with fast resolution speed and strong concurrent processing capabilities. Step 163, by normalizing attributes such as PTR records, EDNS protocol support, software version and vulnerabilities, the security and functionality of the recursive resolver can be comprehensively evaluated from a configuration perspective, which helps to discover potential security risks and enhance configuration optimization opportunities. Step 164, by normalizing the DNS public data source and DNS service provider information and evaluating them using the CRITIC method, the reliability and data transparency of the recursive resolver can be revealed from the perspective of passive data. Step 165, by combining subjective weights (determined by the hierarchical analysis method) and objective weights (determined by the CRITIC method), and using the linear weighting method to determine the comprehensive weight, a comprehensive and objective multi-attribute evaluation model can be constructed. This model comprehensively considers multiple evaluation dimensions, ensuring the accuracy and fairness of the evaluation results. In step 166, the user scale of each recursive resolver is calculated based on the multi-attribute evaluation model, resulting in a quantitative evaluation result. This facilitates direct comparison and ranking of the user scales of different recursive resolvers. In step 167, the user scale is divided into different levels, which can more intuitively demonstrate the user scale level of each recursive resolver.

[0084] like Figure 2 As shown, an embodiment of the present invention further provides a system 20 for evaluating the user scale of a recursive resolver from the outside, comprising:

[0085] An acquisition module 21 is configured to analyze the local user volume of a known recursive resolver using a regional user request quantity module, and divide the local user volume into levels to obtain divided user volume levels; based on the divided user volume levels, measure and analyze attribute characteristics of recursive resolvers of different user scale levels to obtain measurement results;

[0086] The processing module 22 is used to analyze the attribute characteristics of the recursive resolver of different user levels based on the measurement results to obtain the response delay and the number of responding IP addresses of the recursive resolver; obtain the response delay, the number of responding IP addresses and their configuration attributes of the recursive resolver through the attribute configuration module; obtain and analyze passive data; and construct a multi-attribute evaluation model based on the response delay, the number of responding IP addresses, the configuration attributes and the passive data of the recursive resolver to evaluate the user scale level of the DNS recursive resolver.

[0087] Optionally, the attribute characteristics include response delay, number of responding IPs, PTR record status, software version, and support for EDNS, DoH, and DoT encryption protocols.

[0088] Optionally, passive data includes DNS public data sources and DNS service provider information.

[0089] Optionally, get the response latency of the recursive resolver, including:

[0090] Use the domain name resolution module to request the recursive resolver to query the A record of the domain name;

[0091] Get the time T1 from when the user sends the domain name request to when the user receives the response packet;

[0092] Use the ping command to calculate the network time T2 consumed by the user to the DNS recursive server;

[0093] Subtract the network consumption time T2 from the response packet time T1 to obtain the response delay of the recursive server.

[0094] Optionally, get the number of IP addresses that responded to the recursive resolver, including:

[0095] Using the domain name resolution module, multiple detection points request the recursive resolver to query the A record of the domain name and analyze the response message returned by the recursive resolver;

[0096] Extract source IP information from the response message by capturing the packet;

[0097] Record the number of different IP addresses, that is, the number of response IP addresses of the DNS recursive resolver.

[0098] Optionally, acquire and analyze passive data, including:

[0099] Obtain recursive DNS information based on the passive data module;

[0100] From the obtained recursive DNS information, analyze whether each DNS recursive resolver is a public DNS data source;

[0101] From the obtained recursive DNS information, analyze whether the service provider of the DNS recursive resolver can be obtained.

[0102] Optionally, a multi-attribute evaluation model is constructed based on the recursive resolver's response latency, number of responding IP addresses, configuration attributes, and passive data to assess the user scale of the DNS recursive resolver, including:

[0103] Obtain the response latency, number of responding IP addresses, configuration properties, DNS public data sources, and DNS service provider information of the recursive resolver;

[0104] From the perspective of domain name resolution, the response delay and the number of responding IP addresses of the recursive resolver are normalized, and the entropy weight method in the objective weighting method is used to evaluate the domain name resolution performance of the recursive resolver.

[0105] From the perspective of server attribute configuration, the recursive resolver's PTR record, EDNS protocol, software version, and vulnerabilities are normalized;

[0106] From the passive data perspective, we normalize DNS public data sources and DNS service providers, and use the CRITIC method in the objective weighting method to evaluate the passive data of recursive resolvers.

[0107] The subjective weights were determined using the analytic hierarchy process based on domain name resolution, attribute configuration, and passive data, the objective weights were determined using the CRITIC method, and the comprehensive weights were determined using the linear weighting method to construct a multi-attribute evaluation model.

[0108] Calculate the user scale of each DNS recursive resolver based on a multi-attribute evaluation model;

[0109] The user scale of the DNS recursive resolver is divided into levels to obtain the user scale level of each recursive resolver.

[0110] Example 1

[0111] like Figure 3 A system for evaluating the user scale of a recursive resolver from the outside is shown, comprising:

[0112] The regional user request quantity module obtains the regional user request quantity from a certain university campus network, a certain regional LAN, a carrier or a national network exit;

[0113] The DNS recursive resolver local user volume module analyzes the local user volume of the recursive resolver from the collected regional user request numbers and divides them into levels;

[0114] The attribute feature module of the recursive resolver is analyzed. According to the local user volume of the recursive resolver, the attribute features of servers with different user levels are analyzed, and the attributes are used as prior knowledge to classify the user scale of the global recursive resolver.

[0115] A DNS recursive resolver set, that is, obtaining a set of DNS recursive resolvers to be evaluated so as to measure the attribute characteristics of the recursive resolvers;

[0116] Active data module, which obtains the domain name resolution and attribute configuration of the DNS recursive resolver through active measurement;

[0117] The passive data module mainly includes five aspects: collecting passive data, capturing DNS traffic, data preprocessing, extracting recursive resolver information, and evaluating the number of recursive resolver users:

[0118] First, passive data collection, which obtains information by monitoring network traffic or analyzing existing data sets without actively sending requests to the network;

[0119] Second, capture DNS traffic. Deploy packet capture devices or software at key points in the network (such as ISP egress, data center boundaries, etc.) to capture passing DNS query and response traffic.

[0120] Third, the captured data is preprocessed by cleaning and formatting it, removing packets not related to DNS and retaining only DNS query and response records. The captured packets are then converted into a unified format for subsequent analysis.

[0121] Fourth, extract the recursive resolver information. By analyzing the source IP address and port of the DNS query record, identify which queries come from the recursive resolver. At the same time, extract and record the IP address, port, queried domain name, and other information of each identified recursive resolver;

[0122] Finally, we evaluate the number of recursive resolver users. We calculate the number of recursive resolver users by counting the number of queries per recursive resolver within a certain time window, removing duplicate query records, and observing and recording the time series data of the recursive resolver query volume.

[0123] In an embodiment of the present invention, a system for evaluating the user scale of a recursive resolver from the outside also includes:

[0124] The domain name resolution module mainly implements domain name resolution by determining the target domain name and DNS recursive resolver, sending resolution requests, receiving response messages, parsing response messages, and processing results;

[0125] First, determine the target domain name and DNS recursive resolver, that is, determine the target domain name to be resolved and the DNS recursive server. The domain name is usually entered by the user or obtained from other sources, such as resolving the domain name www.baidu.com. The recursive resolver is usually provided by the ISP or a public DNS service such as Google DNS or Cloudflare DNS.

[0126] Secondly, send a resolution request, which specifically includes constructing a DNS query message, sending the message, and waiting for a response. Construct a DNS query message according to the DNS protocol specification. The message usually includes a request header (identification, flags, query quantity, etc.) and a query question part (specify the domain name and query type, such as an A record). After constructing the query message, send the DNS message and send the constructed DNS query message to the IP address and port (usually port 53) of the selected DNS recursive resolver. After that, wait for the DNS recursive resolver to process the request and return a response. The processing time may vary due to factors such as network latency and resolver load;

[0127] Third, receive the response message. This means receiving the response message returned from the DNS recursive resolver and verifying the integrity and validity of the response message to ensure it is a correct response to the original query.

[0128] Fourth, parse the response message, including parsing the response message structure, extracting the domain name A record result, processing additional information, etc. According to the DNS protocol specification, parse the response message structure, including identifying the response header and various resource records (RRs). Afterwards, extract the domain name's A record (IPv4 address) from the response message. The A record is a record type that directly maps the domain name to an IPv4 address. In addition, if the response message contains other relevant information (such as AAAA records, CNAME records, etc.), it can also be processed as needed;

[0129] Fifth, processing results, including result storage and error handling. Result storage involves storing the parsed A record (IPv4 address) in an appropriate data structure for subsequent use. Additionally, if an error (such as a timeout or invalid response) is encountered during the parsing process, appropriate error handling is required, such as retrying and logging errors.

[0130] In an embodiment of the present invention, a system for evaluating the user scale of a recursive resolver from the outside also includes:

[0131] The attribute configuration module reflects the number of users of the DNS recursive resolver by measuring the static attributes of the DNS recursive resolver;

[0132] The recursive resolver response delay module sends a domain name resolution request to the recursive resolver and obtains the time it takes for the resolver to resolve the domain name. The smaller the response delay, the better the recursive resolver's service performance.

[0133] The recursive resolver response IP number module sends a domain name resolution request to the recursive resolver, obtains the source IP from the response message, and counts the number of IPs. If the recursive resolver has multiple response IPs, and the response IPs are distributed in different geographical locations, it means that the server is likely a large distributed DNS architecture (such as DNS public service providers such as Google and CloudFare), which indirectly indicates that the geographical location and number of users served by the recursive DNS server are relatively large;

[0134] Obtain the domain name PTR record. Based on prior knowledge, it is found that large recursive resolvers are generally configured with PTR records. Therefore, request the recursive resolver to resolve the domain name's PTR record and analyze whether it can be successfully resolved. If it can be successfully resolved, analyze whether the answer field of the response message contains geographic location information. For example, request the PTR record of 61.55.212.69 from the Beijing DNS recursive resolver 1.202.140.166, and the result returns hebei.55.61.in-addr.arpa, indicating that the recursive resolver can serve users in Hebei Province, thus reflecting the number of users of the recursive resolver;

[0135] Obtain EDNS protocol support, that is, verify whether the recursive resolver supports the EDNS protocol. DNS recursive resolvers that support the EDNS protocol can provide better performance, stability, IPv6 support, and security, especially for large-scale user networks. It can speed up query processing, reduce TCP-based transmission requirements, and provide users with higher-quality DNS services.

[0136] Obtain software version and vulnerability information, that is, obtain the software version of the recursive resolver and analyze whether there are software vulnerabilities. If the software version is frequently updated and there are no software vulnerabilities, it means that users frequently use it and the administrator maintains it for a long time, which indirectly reflects the user scale of the recursive resolver;

[0137] Obtaining DoH protocol support, that is, verifying whether the recursive resolver supports the DoH protocol. Due to the high deployment cost of the DoH protocol, it is currently only supported by a few large public service providers. Measuring DoH protocol support can reflect the user scale of DNS recursive resolvers;

[0138] Obtaining DoT protocol support means verifying whether the recursive resolver supports the DoT protocol. Due to the high cost of deploying and maintaining DNS servers that support DoT, similar to the DoH protocol, it is only supported by a few large public service providers. Therefore, measuring DoT protocol support can reflect the user scale of DNS recursive resolvers;

[0139] Obtain NSID information, request the DNS recursive resolver to resolve the domain name's A record, and enable the NSID option in the Extended DNS mechanism (EDNS) in the request message to obtain the mirror identification information of the recursive resolver. If the NSID information can be obtained, it means that the recursive resolver has multiple mirror nodes and a large user base;

[0140] The DNS public data source module analyzes passive data to determine whether the DNS recursive resolver is a public data source. DNS public data sources typically collect and aggregate data from various sources, including large ISPs, cloud service providers, security companies, and others. These public data sources can reflect the scale of a server's users, such as 8.8.8.8 serving users worldwide. Therefore, analyzing whether a DNS recursive resolver is a public data source can reflect the server's user base.

[0141] The DNS service provider module obtains the service provider information of the recursive resolver from passive data. The larger the service provider, the larger the user base of the recursive resolver. For example, the service provider of the 8.8.8.8 recursive resolver is Google.

[0142] The multi-attribute evaluation model module integrates all the data obtained above and constructs a user scale evaluation model from three aspects: domain name resolution, attribute configuration, and passive data, using objective weighting methods (such as entropy weight method, TOPSIS method, CRITIC method) and subjective weighting methods (such as hierarchical analysis method);

[0143] The module for evaluating the user scale of DNS recursive resolvers applies a multi-attribute evaluation model to calculate the user scale of DNS recursive resolvers. Based on the calculation results, the user scale of recursive resolvers is classified into different levels.

[0144] In a specific embodiment, the present invention provides a method for evaluating the user scale of a recursive resolver from the outside, comprising:

[0145] 1. Analyze the attribute characteristics of the recursive resolver. The specific steps are as follows:

[0146] Step 1: Analyze the local user volume of the known recursive resolver from the regional user request quantity module and divide it into levels;

[0147] Step 2: Measure the attribute characteristics of recursive resolvers at different user scale levels, such as response latency, number of responding IP addresses, PTR record status, software version, support for EDNS protocol, DoH, DoT and other encryption protocols, etc.

[0148] Step 3: Analyze the attribute characteristics of recursive resolvers at different user levels based on the measurement results. For example, the DoH protocol is only supported by large recursive resolvers. These attribute characteristics are then used as prior knowledge for subsequent user scale measurement of the global recursive resolver.

[0149] 2. Get the response latency of the recursive resolver. The specific steps are as follows:

[0150] Step 1: Use the domain name resolution module to request the recursive resolver to query the A record of the domain name;

[0151] Step 2: Obtain the time T1 from when the user sends the domain name request to when the user receives the response packet;

[0152] Step 3: Use the ping command to calculate the network time T2 consumed by the user to the DNS recursive server;

[0153] Step 4, T1-T2 is the response delay of the recursive server.

[0154] 3. Get the number of IP addresses that respond to the recursive resolver. The specific steps are as follows:

[0155] Step 1: Using the domain name resolution module, multiple detection points request the recursive resolver to query the A record of the domain name and analyze the response message returned by the recursive resolver;

[0156] Step 2: Extract source IP information from the response message by capturing the packet;

[0157] Step 3: Record the number of different IP addresses, that is, the number of response IP addresses of the DNS recursive resolver.

[0158] 4. Get the PTR record of the domain name. The specific steps are as follows:

[0159] Step 1: Request the recursive resolver to resolve the PTR record of the domain name and obtain the resolution result;

[0160] Step 2: Analyze whether the PTR record can be successfully parsed. If so, analyze whether the result returned in the answer field of the response message contains information such as geographic location.

[0161] 5. Obtain EDNS protocol support. The specific steps are as follows:

[0162] Step 1: Send a DNS query of type A to the recursive resolver, with the name being any domain name, and an OPT record added to the additional part of the request packet. The class field is the maximum payload of 4096 bytes for DNS packets under UDP as recommended by RFC6891, and obtain the response message information.

[0163] Step 2: Analyze whether the response message contains an OPT record and whether the class field is not less than 512 bytes. If it exists, it means that the recursive resolver supports the EDNS protocol.

[0164] 6. Obtain the software version and analyze the vulnerability. The specific steps are as follows:

[0165] Step 1: Send a DNS query with name VERSION.BIND, class CH, and type TXT to the recursive resolver and obtain the response message information;

[0166] Step 2: Analyze whether the answer part of the response message contains a resource record with the name VERSION.BIND. If so, the corresponding RDATA part is the DNS software version information of the recursive resolver.

[0167] Step 3: Analyze whether the current software version has any vulnerabilities from the CVE website based on the software version. For example, the CVE website reports that ISC BIND 9 has a security vulnerability. An attacker can exploit this vulnerability to cause an unexpected termination of naming.

[0168] 7. Get DoH protocol support. The specific steps are as follows:

[0169] Step 1: Send an HTTPS request message about DNS query to the recursive resolver, resolve the A record of the domain name, and obtain the response message information with the commonly used URL suffix " / dns-query";

[0170] Step 2: Analyze whether the answer part of the response message returns a result. If a result is returned, the recursive resolver supports the DoH protocol.

[0171] 8. Get the DoT protocol support status. The specific steps are as follows:

[0172] Step 1: Send a TLS request message about DNS query to the recursive resolver, resolve the A record of the domain name, and obtain the response message information;

[0173] Step 2: Analyze whether the answer part of the response message returns a result. If a result is returned, the recursive resolver supports the DoT protocol.

[0174] 9. Get NSID information. The specific steps are as follows:

[0175] Step 1: Request the DNS recursive resolver to resolve the A record of the domain name, and enable the NSID option in the extended DNS mechanism (EDNS) in the request message to obtain the mirror identification information of the recursive resolver.

[0176] Step 2: Analyze whether the NSID information can be returned. If the result is returned normally, it means that the DNS recursive resolver has a mirror node.

[0177] 10. Analyze DNS public data sources and DNS service providers. The specific steps are as follows:

[0178] Step 1: Obtain recursive DNS information based on the passive data module;

[0179] Step 2: Analyze each DNS recursive resolver from the obtained recursive DNS information to see if it is a public DNS data source;

[0180] Step 3: Analyze whether the service provider of the DNS recursive resolver can be obtained from the obtained recursive DNS information.

[0181] 11. Construction and application of multi-attribute evaluation model. The specific steps are as follows:

[0182] Step 1: Obtain the response delay, number of responding IP addresses, configuration attributes, DNS public data sources, DNS service providers, and other information of the recursive resolver from the above module;

[0183] Step 2: From the perspective of domain name resolution, the response delay and number of responding IP addresses of the recursive resolver are first normalized. Then, the entropy weight method in the objective weighting method is used to evaluate the domain name resolution performance of the recursive resolver.

[0184] Step 3, from the perspective of server attribute configuration, first normalize the six aspects of the recursive resolver, including PTR records, EDNS protocol, software version and vulnerabilities. Among them, PTR records are divided into three cases: no PTR record, yes but no geographic information, yes and geographic information; software version and vulnerabilities are divided into four cases: no software version, yes but low software version, yes and high software version, and software vulnerability; the remaining four attributes are divided into two cases: yes / no. After normalization, the hierarchical analysis method in the subjective weighting method is used to evaluate the attribute configuration of the recursive resolver;

[0185] Step 4: From a passive data perspective, we first normalize DNS public data sources and DNS service providers. DNS public data sources are categorized as either public or non-public data sources, and DNS service providers are categorized as no service provider, large service provider, medium-sized service provider, and small service provider. We then use the CRITIC method, an objective weighting method, to evaluate the passive data of recursive resolvers.

[0186] Step 5: Integrate the above results and evaluate the user scale of the recursive resolver based on domain name resolution, attribute configuration, and passive data. First, normalize the data. Then, combine subjective and objective weighting methods, using the Analytic Hierarchy Process to determine subjective weights, the CRITIC method to determine objective weights, and the linear weighting method to determine comprehensive weights, thereby constructing a multi-attribute evaluation model.

[0187] Step 6: Calculate the user scale of each DNS recursive resolver based on the multi-attribute evaluation model. Then, categorize the user scale of the DNS recursive resolvers into different levels to obtain the user scale level of each recursive resolver.

[0188] It should be noted that this system is a system corresponding to the above method, and all implementation methods in the above method embodiment are applicable to this embodiment and can achieve the same technical effects.

[0189] An embodiment of the present invention further provides a computing device comprising: a processor and a memory storing a computer program, wherein the computer program, when executed by the processor, performs the above-described method. All implementations in the above-described method embodiments are applicable to this embodiment and can achieve the same technical effects.

[0190] The embodiment of the present invention further provides a computer-readable storage medium storing instructions, which, when executed on a computer, causes the computer to execute the above-described method. All implementations in the above-described method embodiment are applicable to this embodiment and can achieve the same technical effects.

[0191] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present invention.

[0192] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0193] In the embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interface, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0194] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0195] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0196] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes various media that can store program code, such as a USB flash drive, a mobile hard drive, ROM, RAM, a magnetic disk, or an optical disk.

[0197] In addition, it should be noted that, in the apparatus and method of the present invention, it is obvious that each component or each step can be decomposed and / or recombined. These decompositions and / or recombinations should be regarded as equivalent solutions of the present invention. Moreover, the steps of performing the above-mentioned series of processing can naturally be performed in chronological order according to the order of description, but it is not necessary to perform them in chronological order, and some steps can be performed in parallel or independently of each other. For those of ordinary skill in the art, it will be understood that all or any steps or components of the method and apparatus of the present invention can be implemented in any computing device (including processors, storage media, etc.) or a network of computing devices in hardware, firmware, software or a combination thereof, which can be achieved by those of ordinary skill in the art using basic programming skills after reading the description of the present invention.

[0198] Therefore, the purpose of the present invention can also be achieved by running a program or a group of programs on any computing device. The computing device can be a well-known general-purpose device. Therefore, the purpose of the present invention can also be achieved simply by providing a program product containing program code that implements the method or device. That is to say, such a program product also constitutes the present invention, and the storage medium storing such a program product also constitutes the present invention. Obviously, the storage medium can be any well-known storage medium or any storage medium developed in the future. It should also be pointed out that in the device and method of the present invention, it is obvious that each component or each step can be decomposed and / or recombined. These decompositions and / or recombinations should be regarded as equivalent schemes of the present invention. In addition, the steps of performing the above-mentioned series of processing can naturally be performed in chronological order according to the order of description, but do not necessarily need to be performed in chronological order. Certain steps can be performed in parallel or independently of each other.

[0199] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as within the scope of protection of the present invention.

Claims

1. A method for evaluating the user scale of a recursive resolver from the outside, characterized in that: The method comprises: Analyze the local user scale of the known recursive resolver through the regional user request quantity module, and divide the local user scale into levels to obtain the divided user scale levels; Measure the attribute characteristics of recursive resolvers at different user scale levels according to the user scale levels to obtain measurement results; the attribute characteristics include response latency, number of responding IP addresses, PTR record information, software version, and whether encryption protocols are supported, where the encryption protocols are EDNS, DoH, or DoT; Analyze the attribute characteristics of recursive resolvers at different user scale levels based on the measurement results to obtain the response delay and number of responding IP addresses of recursive resolvers at different user scale levels; Obtain the response delay, number of response IP addresses, and attribute configuration of the recursive resolvers at different user scale levels through the attribute configuration module; Obtain and analyze passive data, including DNS public data sources and DNS service provider information; Based on the recursive resolver's response latency, number of responding IP addresses, attribute configuration, and passive data, a multi-attribute evaluation model is constructed to assess the user scale of the recursive resolver, including: Step S1: From the perspective of domain name resolution, the response delay and the number of responding IP addresses of the recursive resolver are normalized, and the domain name resolution performance of the recursive resolver is evaluated using the entropy weight method in the objective weighting method; Step S2: normalize the PTR record information, EDNS protocol, software version, and vulnerabilities of the recursive resolver from the perspective of server attribute configuration to evaluate the security and functionality of the recursive resolver; Step S3: From a passive data perspective, the DNS public data source and DNS service provider information are normalized, and the reliability and data transparency of the recursive resolver are evaluated using the CRITIC method in the objective weighting method. The results obtained in the above steps S1, S2 and S3 are integrated to determine the subjective weight using the analytic hierarchy process, the objective weight using the CRITIC method, and the comprehensive weight using the linear weighting method to construct a multi-attribute evaluation model; Based on the multi-attribute evaluation model, the user scale of each recursive resolver is calculated.

2. The method for evaluating the user scale of a recursive resolver from the outside according to claim 1, characterized in that: Get the response latency of the recursive resolver, including: Use the domain name resolution module to request the recursive resolver to query the A record of the domain name; Get the time T1 from when the user sends the domain name request to when the user receives the response packet; Use the ping command to calculate the network time T2 consumed by the user to the DNS recursive server; Subtract the network consumption time T2 from the time the user sends the domain name request to the time the response packet is received from T1 to get the response delay of the recursive server.

3. A system for evaluating the user scale of a recursive resolver from the outside, characterized in that include: An acquisition module is configured to analyze the local user scale of a known recursive resolver using a regional user request quantity module, and divide the local user scale into levels to obtain divided user scale levels; based on the divided user scale levels, measure attribute characteristics of recursive resolvers of different user scale levels to obtain measurement results; the attribute characteristics include response latency, number of responding IP addresses, PTR record information, software version, and whether an encryption protocol is supported, where the encryption protocol is EDNS, DoH, or DoT; A processing module, configured to analyze attribute characteristics of recursive resolvers of different user scale levels according to the measurement results, so as to obtain response delays and response IP numbers of the recursive resolvers of different user scale levels; Obtain the response delay, number of response IP addresses, and attribute configuration of the recursive resolvers at different user scale levels through the attribute configuration module; Obtain and analyze passive data, including DNS public data sources and DNS service provider information; Based on the response delay, number of responding IP addresses, attribute configuration, and passive data of the recursive resolver, a multi-attribute evaluation model is constructed to evaluate the user scale level of the recursive resolver, including: step S1, from the perspective of domain name resolution, the response delay and number of responding IP addresses of the recursive resolver are normalized, and the domain name resolution performance of the recursive resolver is evaluated using the entropy weight method in the objective weighting method; step S2, from the perspective of server attribute configuration, the PTR record information, EDNS protocol, software version, and vulnerabilities of the recursive resolver are normalized to evaluate the security and functionality of the recursive resolver; step S3, from the perspective of passive data, the DNS public data source and DNS service provider information are normalized, and the reliability and data transparency of the recursive resolver are evaluated using the CRITIC method in the objective weighting method; the results obtained from the above steps S1, S2, and S3 are integrated, the subjective weight is determined using the hierarchical analysis method, the objective weight is determined according to the CRITIC method, and the comprehensive weight is determined using the linear weighting method to construct the multi-attribute evaluation model; based on the multi-attribute evaluation model, the user scale of each recursive resolver is calculated.

4. A computing device, characterized in that include: one or more processors; A storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 3.

5. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a program, which implements the method according to any one of claims 1 to 3 when executed by a processor.

Images