Domain name resolution method and device, storage medium and electronic device

Abstract

The application relates to the technical field of computer networks, and provides a domain name resolution method and device, a storage medium and electronic equipment, the domain name resolution method comprises the following steps: obtaining passive domain name resolution flow data; querying resource records associated with a target domain name in the passive domain name resolution flow data to obtain a resource record set, wherein the resource records represent the corresponding relationship between network resources, and the network resources comprise domain names or IP addresses; generating a resolution dependency topology graph of the target domain name according to the resource record set, wherein the nodes in the resolution dependency topology graph represent network resources, and the directed edges connecting the nodes in the resolution dependency topology graph represent the resolution dependency relationship of the network resources in domain name resolution. The domain name resolution method is based on passive domain name resolution flow data to realize the rapid construction of a domain name resolution dependency topology graph, does not need to actively initiate a large-scale domain name query request to a domain name resolution server, does not exist network delay, reduces the consumption of network resources, and improves the resolution efficiency.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer networks, and in particular to a domain name resolution method and device, a storage medium and an electronic device. BACKGROUND

[0002] Domain name resolution is the process of converting user-entered domain names into corresponding IP addresses, so that computers can accurately locate and access target servers or network resources. It plays an important role in website access, email communication, cloud service deployment application, content distribution and load balancing, and network threat analysis and detection. However, the multi-level and complex dependency relationship between domain names makes it difficult to achieve a comprehensive and efficient domain name resolution process.

[0003] The domain name resolution dependency mainly comes from the hierarchical structure of domain names, the hierarchical architecture of the Domain Name System (DNS) and the domain name alias mechanism. The hierarchical structure of domain names leads to the need for each level of domain name to determine the authoritative server address of the next level domain name through resolution, forming a dependency relationship for resolution. The hierarchical architecture of DNS includes root domain name authoritative servers, top-level domain name authoritative servers and valid second-level domain name authoritative servers. The resolution process needs to query the upper-level servers one by one, forming a multi-level dependency relationship. The domain name alias mechanism makes the authorized resolution process of a domain name transferred to the authoritative servers of another domain name at each level.

[0004] The current domain name resolution process mainly relies on two types of active resolution methods: iterative resolution and recursive resolution. The limitations of active resolution methods are that multiple queries and response interactions are required, resulting in high resolution process delay, and a large amount of network resources are consumed by the resolution server when facing a large number of query requests. SUMMARY

[0005] The present application provides a domain name resolution method, device, storage medium and electronic device to solve the defect that the existing domain name resolution process needs to iteratively perform active domain name resolution queries, resulting in a large consumption of network resources, to achieve a more efficient domain name resolution process and reduce network load.

[0006] The present application provides a domain name resolution method, comprising: querying resource records associated with a target domain name in passive domain name resolution traffic data to obtain a resource record set, the resource records representing the corresponding relationship between network resources, the network resources including domain names or IP addresses; generating a resolution dependency topology graph of the target domain name according to the resource record set, the nodes in the resolution dependency topology graph representing network resources, and the directed edges connecting the nodes in the resolution dependency topology graph representing the resolution dependency relationship between network resources in domain name resolution.

[0007] The application provides a domain name resolution method, characterized in that the method comprises the following steps: querying resource records associated with a target domain name in passive domain name resolution traffic data to obtain a resource record set, wherein the resource records represent the corresponding relationship between network resources, and the network resources comprise domain names or IP addresses; and generating a resolution dependency topology graph of the target domain name according to the resource record set.

[0008] The application provides a domain name resolution method, characterized in that the method comprises the following steps: obtaining the start and end times of the access of the resource records in the resource record set; determining the life cycle of the resource records in the resource record set according to the start and end times; analyzing the resolution dependency relationship between the resource records with overlapping life cycles in the resource record set; and generating the resolution dependency topology graph according to the resolution dependency relationship.

[0009] The application provides a domain name resolution method, characterized in that the method comprises the following steps: determining whether there is mutual exclusivity between the types of the resource records corresponding to the resolution dependency relationship according to the domain name system protocol; and generating the resolution dependency topology graph according to the resolution dependency relationship if there is no mutual exclusivity between the types of the resource records.

[0010] The application provides a domain name resolution method, characterized in that the method further comprises the following steps after the step of generating the resolution dependency topology graph of the target domain name according to the resource record set: identifying the ring structure in the resolution dependency topology graph by using a depth-first search algorithm; and eliminating the ring structure based on a pre-set modification rule.

[0011] The application provides a domain name resolution method, characterized in that the method further comprises the following steps before the step of generating the resolution dependency topology graph of the target domain name according to the resource record set: screening the resource records in the resource record set according to a pre-defined domain name syntax rule, and retaining the resource records in the resource record set that meet the domain name syntax rule.

[0012] The application further provides a domain name resolution device, which comprises: an acquisition module configured to acquire passive domain name resolution traffic data; a query module configured to query resource records associated with a target domain name in the passive domain name resolution traffic data to obtain a resource record set, wherein the resource records represent the corresponding relationship between network resources, and the network resources comprise domain names or IP addresses; and a generation module configured to generate a resolution dependency topology graph of the target domain name according to the resource record set, wherein the nodes in the resolution dependency topology graph represent network resources, and the directed edges connecting the nodes in the resolution dependency topology graph represent the resolution dependency relationship between the network resources in domain name resolution.

[0013] According to the domain name resolution device provided by the application, the query module is further configured to query resource records associated with the target domain name and having access data greater than a preset threshold in the passive domain name resolution traffic data, and obtain a resource record set.

[0014] According to the domain name resolution device provided by the application, the generation module is further configured to obtain start and end times of access of the resource records in the resource record set, determine life cycles of the resource records in the resource record set according to the start and end times, analyze a resolution dependency relationship between resource records with overlapping life cycles in the resource record set, and generate the resolution dependency topology graph according to the resolution dependency relationship.

[0015] According to the domain name resolution device provided by the application, the generation module is further configured to determine whether there is mutual exclusivity between types of resource records corresponding to the resolution dependency relationship according to a domain name system protocol, and generate the resolution dependency topology graph according to the resolution dependency relationship if there is no mutual exclusivity between the types of resource records.

[0016] According to the domain name resolution device provided by the application, the device further comprises an identification module configured to identify a ring structure in the resolution dependency topology graph by using a depth-first search algorithm, and an elimination module configured to eliminate the ring structure based on a preset modification rule.

[0017] According to the domain name resolution device provided by the application, the device further comprises a screening module configured to screen the resource records in the resource record set according to a predefined domain name syntax rule, and retain resource records in the resource record set that meet the domain name syntax rule.

[0018] The application further provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the domain name resolution method according to any of the above when executing the program.

[0019] The application further provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program is executable on a processor to implement the domain name resolution method according to any of the above.

[0020] The application further provides a computer program product comprising a computer program, wherein the computer program is executable on a processor to implement the domain name resolution method according to any of the above.

[0021] The domain name resolution method, device, storage medium and electronic equipment provided by the application realize quick construction of a domain name resolution dependent topology graph based on passive domain name resolution traffic data, do not need to actively initiate a large-scale domain name query request to a domain name resolution server, do not exist network delay, reduce consumption of network resources, and improve resolution efficiency. BRIEF DESCRIPTION OF DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the application or prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative effort on the basis of these drawings.

[0023] Figure 1 It is a schematic diagram of a recursive resolution process of a domain name system.

[0024] Figure 2 It is a flowchart of the domain name resolution method provided by the application.

[0025] Figure 3 It is an exemplary resolution dependent topology graph in the application.

[0026] Figure 4 It is a structural schematic diagram of the domain name resolution device provided by the application.

[0027] Figure 5 It is a structural schematic diagram of the electronic equipment provided by the application. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical solutions and advantages of the application more clear, the technical solutions in the application will be described clearly and completely in the following with reference to the drawings in the application. Obviously, the described embodiments are some embodiments of the application, not all embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative effort belong to the protection scope of the application.

[0029] The following will describe the domain name resolution method, device, storage medium and electronic equipment of the application. Figures 1-5

[0030] ​A domain name consists of a string of dots separated by periods, including the domain body and the domain suffix. For example, the domain example.com has "example" as the domain body and ".com" as the domain suffix. The domain body typically contains the organization name or website name, indicating the domain owner or website content; the domain suffix usually indicates the type of organization or the country or region where the domain is located. The domain name space is a hierarchical structure, divided from top to bottom into root domains, top-level domains (first-level domains), second-level domains, third-level domains, and more. For example, "." is the root domain, ".com" is the first-level domain, and "example.com" is the second-level domain. It's important to note that the last dot "." in a domain name is generally omitted, so "example.com" should actually be represented as "example.com.". In this example, for simplicity, the last dot "." is omitted. Corresponding to the hierarchy of the domain name space, based on the domain name information mainly stored by the domain name server and its role in the domain name resolution process, domain name servers can be divided into root name servers, top-level domain name servers, and authoritative name servers.

[0031] like Figure 1 As shown, the client sends a query request to the DNS resolver to find the IP address of the domain name example.com. When the DNS resolver finds that the IP address of the domain name example.com is not in its local cache, it sends a query request to the root name server. The root name server replies to the DNS resolver with reference information about the top-level name server, which may include the IP address of that top-level name server. After obtaining the IP address of the top-level name server, the DNS resolver sends a query request to that top-level name server to find the IP address of the domain name example.com. The top-level name server replies to the DNS resolver with reference information about the second-level name server that manages the domain name example.com, which may include the IP address of that second-level name server.

[0032] Since this second-level name server is the authoritative name server managing the domain example.com, when the domain name resolver sends a query to this second-level name server to retrieve the IP address of the domain example.com, the second-level name server can reply with the IP address of the domain example.com to the domain name resolver. This reply from the second-level name server is the final authoritative reply. Therefore, the domain name resolver can ultimately reply to the client with the IP address of the domain example.com obtained through recursive resolution.

[0033] Figure 2is a flowchart of a domain name resolution method provided by an embodiment of the present application, as shown in Figure 2 The method comprises the following steps: in step 201, passive domain name resolution traffic data is acquired.

[0034] In this embodiment, passive domain name resolution traffic data refers to data collected by listening to domain name system requests and responses in the network, rather than actively sending DNS queries. The passive domain name resolution traffic data can be acquired through domain name resolution history data sets provided by public DNS service providers, or can be acquired by using passive domain name resolution traffic collection technology. Passive domain name resolution traffic collection is a technology for collecting and analyzing DNS resolution traffic data. This technology collects DNS request and response data generated by other devices on the network, and is usually used in the fields of network security and network monitoring. The main steps of passive domain name resolution traffic collection can include: (1) capturing network traffic, i.e. capturing DNS request and response data by listening to DNS query traffic through a domain name resolver; (2) extracting DNS data, i.e. extracting relevant information of DNS request and response such as requested domain name, responded IP address, request and response time, etc. from the captured DNS query traffic; (3) storing DNS data, i.e. storing the extracted DNS data in a database for subsequent query and analysis. Researchers or network administrators can discover abnormal behaviors, attack activities, malicious domain names, etc. in the network through passive domain name resolution traffic.

[0035] As an example, passive domain name resolution traffic data can be collected by a DNS recursive resolver. A DNS recursive resolver (also known as a recursive server) is a server that receives and responds to DNS queries from clients (such as personal computers, smartphones, etc.). The recursive server will make a series of queries in the DNS hierarchy until it finds the IP address corresponding to the requested domain name, and then returns the IP address to the client. In terms of service objects and service scope, recursive resolvers include public recursive resolvers, carrier (ISP) recursive resolvers, recursive resolvers of enterprises or organizations, and open recursive resolvers, etc. The more clients using the recursive resolver, the larger the DNS request traffic handled, and the more complete the dependency topology graph of domain name resolution built by the present application.

[0036] In step 202, resource records associated with a target domain name in the passive domain name resolution traffic data are queried to obtain a resource record set.

[0037] In this embodiment, the target domain name refers to a domain name for which a domain name resolution dependency topology needs to be constructed. A resource record (RR) is a basic data structure in a DNS database, used to store mapping information between domain names and network resources. A resource record consists of multiple fields, including domain name, class, type, time to live (TTL), data length, and data. The types of resource records include, but are not limited to, A records (records mapping domain names to IPv4 addresses), AAAA records (records mapping domain names to IPv6 addresses), CNAME records (records setting aliases for domain names), NS records (records indicating which DNS server is responsible for resolving a domain name), and MX records (records indicating the address of a domain name mail server).

[0038] Since the domain name alias mechanism allows multiple domain names to share the same target resource or dynamically resolves domain names to multiple entries, it introduces an extension of the domain name resolution chain, making the domain name resolution dependency further complicated and increasing the complexity and delay of the resolution process. In order to achieve comprehensive and efficient domain name resolution, the configuration of domain name hierarchy, DNS architecture, and domain name alias mechanism can be considered comprehensively to optimize the resolution dependency and improve the resolution performance.

[0039] Querying resource records associated with the target domain name can include querying resource records directly associated with the target domain name and indirectly associated with the target domain name. Direct association refers to the domain name field of the resource record completely matching the target domain name, and indirect association refers to the domain name field of the resource record not completely matching the target domain name, but matching a domain name that has a hierarchical relationship or alias relationship with the target domain name. For example, for CNAME type records, the target domain name is associated with another domain name, and further querying the resolution of this domain name is needed to obtain the IP address. At this time, the "response resource" can be used as the "query domain name", and all resource records corresponding to the "response resource" can be recursively found until the resource type is A, NS, or MX. Alternatively, a machine learning method can be used to train a model to automatically identify and extract resource records related to the target domain name.

[0040] Optionally, to ensure that the resource records queried from passive domain name resolution traffic have relative timeliness and accuracy, query conditions such as access volume data exceeding a preset threshold or resource records meeting a predefined format specification can be added to filter out long-tail resolution data or error data with less access times.

[0041] Step 203: generating a resolution dependency topology graph of the target domain name according to the set of resource records.

[0042] In the embodiment, the node in the parsing dependency topology graph represents a network resource, the network resource includes a domain name or an IP address, and the directed edge connecting the nodes in the parsing dependency topology graph represents the parsing dependency relationship of the network resource in the domain name resolution. The parsing dependency topology graph can provide important technical support for analyzing and optimizing the network topology structure, locating and excluding the domain name resolution fault node, detecting abnormal domain name resolution and domain name association phenomenon, and the like. In addition, it also helps to provide more comprehensive and accurate network intelligence support. Figure 3 is an exemplary parsing dependency topology graph in the application, Figure 3 In the embodiment, the domain name resource 1 is parsed and mapped to the domain name resource 2, the domain name resource 3 and the domain name resource 4 through the CNAME record, the domain name resource 2 is parsed and mapped to the domain name resource 5 through the CNAME record, and the domain name resource 3 and the domain name resource 4 are parsed to the IP address resource 2 through the A record. Figure 3 In the embodiment, only the common CNAME type and A type resource records are taken as examples to construct the parsing dependency topology graph of the domain name, and in practice, any type of resource record can be covered.

[0043] In the embodiment, the parsing dependency topology graph can include a plurality of parsing chains. By analyzing the resource records associated with the target domain name in the passive domain name resolution traffic data, the domain name resolution chain with time sequence association and dependency relationship can be constructed. Such chain not only shows the parsing order between the domain names, but also reveals the dependency therebetween. For example, a single domain name can be parsed and mapped to a plurality of IP addresses, and then the domain name and the related IP will be converted into a tree structure of one-to-many. A domain name A can be parsed and mapped to another domain name B through CNAME, and then further parsed to an IP address C, and then the three resources A, B and C will be converted into a chain structure.

[0044] In the embodiment, the resource records appearing in the passive domain name resolution traffic can be mined and associated, and then quickly converted into a domain name deep-level parsing dependency topology with time sequence association and dependency relationship. Specifically, a graph-based method can be used to associate the parsing dependency relationship between the network resources, or a machine learning method can be used to construct a model to associate the parsing dependency relationship between the network resources to quickly recover the multi-level domain name parsing dependency relationship.

[0045] The domain name resolution method provided by the application can quickly construct the domain name resolution dependency topology graph based on the passive domain name resolution traffic data, does not need to actively initiate a large-scale domain name query request to the domain name resolution server, does not exist network delay, reduces the consumption of network resources, and improves the resolution efficiency.

[0046] In some optional implementation manners, the generating of the resolution dependency topology graph of the target domain name according to the resource record set comprises: obtaining start and end times of access of the resource records in the resource record set; determining life cycles of the resource records in the resource record set according to the start and end times; analyzing resolution dependency relationships between the resource records with overlapped life cycles in the resource record set; and generating the resolution dependency topology graph according to the resolution dependency relationships. The resource records have overlapped life cycles, which means that multiple resource records are valid in the same time period. The resolution dependency topology graph is generated according to the resolution dependency relationships between the resource records with overlapped life cycles, so that the resolution dependency relationships can be more accurately constructed, and the loop structure or other error conditions in the resolution dependency topology graph can be avoided.

[0047] In some optional implementation manners, the generating of the resolution dependency topology graph according to the resolution dependency relationships comprises: determining whether there is mutual exclusivity between types of the resource records corresponding to the resolution dependency relationships according to the domain name system protocol; and if there is no mutual exclusivity between the types of the resource records, generating the resolution dependency topology graph according to the resolution dependency relationships. Whether there is mutual exclusivity between the types of the resource records can be determined according to the specification constraints in the Internet standards RFC1034 and RFC1035, for example, NS records and MX records usually do not contain CNAME records. This implementation manner can further improve the accuracy of the generated resolution dependency topology graph.

[0048] In some optional implementation manners, after the generating of the resolution dependency topology graph of the target domain name according to the resource record set, the method further comprises: identifying a loop structure in the resolution dependency topology graph by using a depth-first search algorithm; and eliminating the loop structure based on a pre-set modification rule. Since the resolution result of each domain name is a determined Internet resource, each resolution dependency topology graph is a directed acyclic graph. The loop in each resolution dependency topology graph can be identified by using the depth-first search in the graph search algorithm, and the loop structure can be eliminated according to the pre-set elimination rule when the resource is repeatedly present. The elimination rule can be established according to the specific problems encountered, for example, the elimination rule can be established based on the life cycle. If the life cycles of the resource records are not overlapped, that is, they are not valid at the same time, the timestamps can be used to determine which records should be included in the same link of the topology graph. The elimination rule can also be established based on the priority. When the loop structure is detected, the records with high priority are retained according to the pre-set priority rule, and the records with low priority are removed or ignored.

[0049] In some optional implementation manners, before the generating of the resolution dependency topology graph of the target domain name according to the resource record set, the method further comprises: screening the resource records in the resource record set according to a pre-defined domain name syntax rule, and retaining the resource records in the resource record set that meet the domain name syntax rule.

[0050] In the present implementation, the domain name syntax rules can be predefined by using Internet standards RFC1034 and RFC1035. A domain name is composed of a series of labels, each of which is a sequence of characters with a maximum length of 63 characters. The standard limits the character set in the domain name to the ASCII character set, including uppercase and lowercase letters (A-Z, a-z), digits (0-9) and hyphen (-), and a dot (.) is used as a separator between labels in the domain name. The domain name is represented in a hierarchical structure from right to left, for example, the top-level domain (TLD) is on the rightmost side, and the subdomain name extends to the left level by level. The end of the domain name can contain a dot (.), indicating a fully qualified domain name (FQDN), and the end dot can be omitted according to the context. In addition, the domain name in the DNS is case-insensitive, but it is generally recommended to use lowercase letters for representation. By using the above syntax specification, the format illegal domain name in the passive flow can be filtered, and the legality of the domain name identification in the constructed resolution dependency chain is ensured.

[0051] In some optional implementations, querying the resource records associated with the target domain name in the passive domain name resolution flow data to obtain a resource record set includes: querying the resource records associated with the target domain name and having access data greater than a preset threshold in the passive domain name resolution flow data to obtain the resource record set. The access data can be the number of accesses or the access frequency, for example, it can be the daily average access amount of the resource record, so that the domain name resolution resource record accessed and obtained by Internet users can be filtered, that is, the long tail resolution data with less access times is filtered out, and the efficiency of domain name resolution is further improved.

[0052] The domain name resolution device provided by the present application is described below, and the domain name resolution device described below can be referred to in correspondence with the domain name resolution method described above.

[0053] Figure 4 The structure diagram of the domain name resolution device provided by the present application is shown in Figure 4 The structure diagram of the domain name resolution device provided by the present application is shown in

[0054] In the embodiment, the specific processing of the obtaining module 401, the querying module 402 and the generating module 403 of the domain name resolution device can refer to the processing of the corresponding embodiment. Figure 2 The steps 201, 202 and 203 in the corresponding embodiment.

[0055] The domain name resolution device provided by the application realizes the fast construction of the resolution dependency topology graph based on the passive domain name resolution traffic data, does not need to actively initiate a large-scale domain name query request to the domain name resolution server, does not exist network delay, reduces the consumption of network resources, and improves the resolution efficiency.

[0056] In some optional implementation manners, the generating module 403 is further configured to: obtain the start and end time of the access of the resource records in the resource record set; determine the life cycle of the resource records in the resource record set according to the start and end time; analyze the resolution dependency relationship between the resource records with overlapped life cycles in the resource record set; and generate the resolution dependency topology graph according to the resolution dependency relationship.

[0057] In some optional implementation manners, the generating module 403 is further configured to: determine whether there is mutual exclusivity between the types of the resource records corresponding to the resolution dependency relationship according to the domain name system protocol; and if there is no mutual exclusivity between the types of the resource records, generate the resolution dependency topology graph according to the resolution dependency relationship.

[0058] In some optional implementation manners, the device further comprises an identifying module configured to identify the loop structure in the resolution dependency topology graph by using a depth-first search algorithm; and an eliminating module configured to eliminate the loop structure based on a pre-set modification rule.

[0059] In some optional implementation manners, the device further comprises a screening module configured to screen the resource records in the resource record set according to a pre-defined domain name syntax rule, and retain the resource records in the resource record set that meet the domain name syntax rule.

[0060] In some optional implementation manners, the querying module 402 is further configured to: query the resource records associated with the target domain name and with access data greater than a preset threshold in the passive domain name resolution traffic data, and obtain the resource record set.

[0061] Figure 5 An example of an entity structure diagram of an electronic device is shown in FIG. 1. Figure 5As shown, the electronic device can include a processor 510, a communications interface 520, a memory 530, and a communications bus 540, wherein the processor 510, the communications interface 520, and the memory 530 complete mutual communication through the communications bus 540. The processor 510 can invoke a logical instruction in the memory 530 to execute a domain name resolution method, which includes: obtaining passive domain name resolution traffic data; querying a resource record associated with a target domain name in the passive domain name resolution traffic data to obtain a resource record set, the resource record representing a corresponding relationship between network resources, the network resources including domain names or IP addresses; generating a resolution dependency topology graph of the target domain name according to the resource record set, a node in the resolution dependency topology graph representing a network resource, and a directed edge connecting the nodes in the resolution dependency topology graph representing a resolution dependency relationship of the network resources in domain name resolution.

[0062] In addition, the logical instruction in the memory 530 described above can be implemented in the form of a software function unit and sold or used as an independent product, and can be stored in a computer-readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, includes several instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in various embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0063] On the other hand, the present application also provides a computer program product, which includes a computer program, the computer program can be stored on a non-transitory computer readable storage medium, and the computer program is executed by a processor, so that the computer can execute the domain name resolution method provided by the above-mentioned methods, which includes: obtaining passive domain name resolution traffic data; querying a resource record associated with a target domain name in the passive domain name resolution traffic data to obtain a resource record set, the resource record representing a corresponding relationship between network resources, the network resources including domain names or IP addresses; generating a resolution dependency topology graph of the target domain name according to the resource record set, a node in the resolution dependency topology graph representing a network resource, and a directed edge connecting the nodes in the resolution dependency topology graph representing a resolution dependency relationship of the network resources in domain name resolution.

[0064] In yet another aspect, the present application also provides a non-transitory computer readable storage medium having stored thereon a computer program, which, when executed by a processor, implements a domain name resolution method provided by any of the above methods, the method comprising: obtaining passive domain name resolution traffic data; querying resource records associated with a target domain name in the passive domain name resolution traffic data to obtain a resource record set, the resource records representing a correspondence between network resources, the network resources including domain names or IP addresses; generating a resolution dependency topology graph of the target domain name according to the resource record set, a node in the resolution dependency topology graph representing a network resource, and a directed edge connecting the nodes in the resolution dependency topology graph representing a resolution dependency relationship between the network resources in domain name resolution.

[0065] The apparatus embodiments described above are merely illustrative, wherein the units described as separate components can or can not be physically separate, and the components displayed as units can or can not be physical units, i.e., can be located in one place, or can be distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the present embodiment scheme according to actual needs. Those skilled in the art can understand and implement without creative labor.

[0066] From the above description of the embodiments, those skilled in the art can clearly understand that the embodiments can be realized by means of software plus necessary universal hardware platforms, and of course can also be realized by hardware. Based on such understanding, the above technical solutions, essentially or in other words, the part that contributes to the prior art, can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods described in each embodiment or some parts of the embodiments.

[0067] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement to some technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A domain name resolution method, characterized by, The method comprises: acquiring passive domain name resolution traffic data; querying resource records associated with a target domain name in the passive domain name resolution traffic data to obtain a resource record set, the resource records representing corresponding relationships between network resources, the network resources including domain names or IP addresses; generating a resolution dependency topology graph of the target domain name according to the resource record set, nodes in the resolution dependency topology graph representing network resources, and directed edges connecting the nodes in the resolution dependency topology graph representing resolution dependency relationships between the network resources in domain name resolution; wherein the generating of the resolution dependency topology graph of the target domain name according to the resource record set comprises: acquiring start and end times of access to the resource records in the resource record set; determining lifecycles of the resource records in the resource record set according to the start and end times; analyzing resolution dependency relationships between resource records with overlapping lifecycles in the resource record set; generating the resolution dependency topology graph according to the resolution dependency relationships.

2. The domain name resolution method of claim 1, wherein, The querying of the resource records associated with the target domain name in the passive domain name resolution traffic data to obtain the resource record set comprises: querying resource records associated with the target domain name and having access data greater than a preset threshold in the passive domain name resolution traffic data to obtain the resource record set.

3. The domain name resolution method of claim 1, wherein, The generating of the resolution dependency topology graph according to the resolution dependency relationships comprises: determining whether there is mutual exclusivity between types of resource records corresponding to the resolution dependency relationships according to a domain name system protocol; if there is no mutual exclusivity between the types of resource records, generating the resolution dependency topology graph according to the resolution dependency relationships.

4. The domain name resolution method of claim 1, wherein, After the generating of the resolution dependency topology graph of the target domain name according to the resource record set, the method further comprises: identifying loop structures in the resolution dependency topology graph using a depth-first search algorithm; and eliminating the loop structures based on a preset modification rule.

5. The domain name resolution method of claim 1, wherein, Before the generating of the resolution dependency topology graph of the target domain name according to the resource record set, the method further comprises: screening the resource records in the resource record set according to a predefined domain name syntax rule, and retaining resource records in the resource record set that conform to the domain name syntax rule.

6. A domain name resolution apparatus characterized by comprising: The method comprises: an acquisition module configured to acquire passive domain name resolution traffic data; a querying module configured to query resource records associated with a target domain name in the passive domain name resolution traffic data to obtain a resource record set, the resource records representing corresponding relationships between network resources, the network resources including domain names or IP addresses; a generating module configured to generate a resolution dependency topology graph of the target domain name according to the resource record set, nodes in the resolution dependency topology graph representing network resources, and directed edges connecting the nodes in the resolution dependency topology graph representing resolution dependency relationships between the network resources in domain name resolution wherein the generating of the resolution dependency topology graph of the target domain name according to the resource record set comprises: acquiring start and end times of access to the resource records in the resource record set; determining lifecycles of the resource records in the resource record set according to the start and end times; analyzing resolution dependency relationships between resource records with overlapping lifecycles in the resource record set; generating the resolution dependency topology graph according to the resolution dependency relationships. analyzing a resolution dependency relationship between resource records with life cycle overlap in the resource record set; generating the resolution dependency topology graph according to the resolution dependency relationship.

7. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor implements the domain name resolution method of any one of claims 1 to 5 when executing the program.

8. A non-transitory computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the domain name resolution method of any one of claims 1 to 5.

9. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the domain name resolution method of any one of claims 1 to 5. The computer program is executed by the processor to implement the domain name resolution method of any one of claims 1 to 5.

Images