Domain name behavior-based pcdn device user determination method and apparatus

Abstract

The application provides a PCDN equipment user determination method and device based on domain name behavior, and relates to the technical field of network data processing. The method comprises the following steps: analyzing the traffic in the running process of the PCDN equipment to determine characteristic data; analyzing the to-be-identified domain name in the DNS cache log of the to-be-identified equipment and the traffic data corresponding to the to-be-identified domain name according to the characteristic data to determine the total weight of the to-be-identified domain name; and determining whether the to-be-identified equipment is a PCDN equipment according to the total weight of the to-be-identified domain name. The DNS cache log is analyzed through domain name characteristics, communication characteristics and behavior characteristics, the identification of the PCDN equipment is realized, and the accuracy of the identification of the PCDN equipment is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network data processing, and particularly relates to a PCDN equipment user determination method and device based on domain name behavior. BACKGROUND

[0002] In recent years, with the rapid growth of network traffic, content distribution networks (CDN) play a key role in improving user experience and reducing network congestion. In order to further improve the efficiency of content distribution and reduce costs, P2P CDN (PCDN) technology has been widely used. However, some PCDN users use this service in violation of regulations, which seriously affects the normal business of telecom operators. Therefore, it is crucial for telecom operators to quickly and accurately detect PCDN users in violation.

[0003] Traditional PCDN detection methods mainly rely on analysis of AAA (Authentication, Authorization, and Accounting) radius traffic. Through AAA traffic, operators can obtain user uplink and downlink bandwidth data, and then determine which users may be PCDN users according to certain threshold values. These threshold values are generally set based on the bandwidth utilization patterns of normal network usage behavior, for example, when a user's uplink bandwidth utilization rate is much higher than the downlink bandwidth utilization rate, he may be considered a potential PCDN user.

[0004] But in fact, PCDN equipment itself will access a large number of normal website domains or CDN node content to confirm its own status, network location, network quality, complete scheduling, and obtain resources, making it difficult to determine which domain names can effectively limit PCDN. At the same time, uncertain suspicious interaction domain names may greatly reduce the final recognition features, and the accuracy of PCDN equipment recognition is low. SUMMARY

[0005] The present application aims to at least solve one of the technical problems in the related art to some extent.

[0006] To this end, a first object of the present application is to provide a PCDN equipment user determination method based on domain name behavior.

[0007] A second object of the present application is to provide a device.

[0008] A third object of the present application is to provide an electronic device.

[0009] A fourth object of the present application is to provide a computer-readable storage medium.

[0010] A fifth object of the present application is to provide a computer program product.

[0011] To achieve the above objectives, the first aspect of this application proposes a method for determining PCDN device users based on domain name behavior, including:

[0012] Traffic during the operation of Personal Content Delivery Network (PCDN) devices is analyzed to determine characteristic data, which includes: domain name characteristics, communication characteristics, and behavioral characteristics.

[0013] The total weight of the domain name to be identified is determined by analyzing the domain name to be identified in the DNS cache log of the device to be identified and the traffic data corresponding to the domain name to be identified based on the feature data.

[0014] The determination of whether the device to be identified is a PCDN device is based on the total weight of the domain name to be identified.

[0015] Optionally, the analysis of traffic during the operation of the PCDN device to determine characteristic data includes:

[0016] Search for domain names in the domain name registration records that are related to the group to which the PCDN device belongs;

[0017] Extract the feature words from the domain name to be analyzed, and combine the feature words to form the domain name features.

[0018] Optionally, the analysis of traffic during the operation of the PCDN device to determine characteristic data includes:

[0019] The corresponding communication service type is determined based on the traffic data corresponding to the domain name to be analyzed;

[0020] A first weight is configured for each of the communication service types, and the communication feature is formed based on the communication service type and the first weight.

[0021] Optionally, the analysis of traffic during the operation of the PCDN device to determine characteristic data includes:

[0022] Determine the behavior of the domain name to be analyzed by determining the traffic data corresponding to the domain name to be analyzed.

[0023] Each of the behaviors is assigned a corresponding second weight, and the behavior features are formed based on the second weight and the corresponding behavior.

[0024] Optionally, the behavioral characteristics include at least one of the following:

[0025] Request interval, request frequency, requested resource type, request CNAME, number of domains for requesting CNAME.

[0026] Optionally, the step of analyzing the domain name to be identified in the DNS cache log of the device to be identified and the traffic data corresponding to the domain name to be identified based on the feature data to determine the total weight of the domain name to be identified includes:

[0027] The domain name to be identified is matched with the feature words, and the domain name to be identified containing the feature words is determined as the domain name to be identified;

[0028] The pending domain name is analyzed based on communication characteristics to determine the communication service type and corresponding first weight of the pending domain name;

[0029] The traffic data of the domain name to be determined is analyzed based on behavioral characteristics to determine the behavior of the domain name to be determined and the corresponding second weight.

[0030] The behaviors are weighted according to the second weight and then summed, and the sum is multiplied by the first weight to obtain the total weight.

[0031] Optionally, determining whether the device to be identified is a PCDN device based on the total weight of the domain name to be identified includes:

[0032] The total weight is compared with a preset weight threshold. If the total weight is greater than the weight threshold, the device to be identified is determined to be a PCDN device.

[0033] If the total weight is less than or equal to the weight threshold, then the device to be identified is determined not to be a PCDN device.

[0034] To achieve the above objectives, a second aspect of this application provides a PCDN device user determination apparatus based on domain name behavior, comprising:

[0035] The feature acquisition module is used to analyze the traffic during the operation of the PCDN device to determine feature data, wherein the feature data includes: domain name features, communication features, and behavioral features;

[0036] The analysis module is used to analyze the domain name to be identified in the DNS cache log of the device to be identified and the traffic data corresponding to the domain name to be identified based on the feature data to determine the total weight of the domain name to be identified.

[0037] The identification module is used to determine whether the device to be identified is a PCDN device based on the total weight of the domain name to be identified.

[0038] To achieve the above objectives, a third aspect of this application provides an electronic device, including: a processor, and a memory communicatively connected to the processor;

[0039] The memory stores computer-executed instructions;

[0040] The processor executes computer execution instructions stored in the memory to implement the method as described in any one of the first aspects.

[0041] To achieve the above objectives, a fourth aspect of this application provides a computer-readable storage medium storing computer-executable instructions that, when executed by a processor, are used to implement the method as described in any one of the first aspects.

[0042] To achieve the above objectives, a fifth aspect of this application provides a computer program product that, when executed by a processor, implements the method described in any one of the first aspects.

[0043] The method, apparatus, electronic device, and storage medium for determining PCDN device users based on domain name behavior provided in this application determine feature data by analyzing the traffic during the operation of the PCDN device, and analyze the logs in the device to be identified based on the feature data to analyze the characteristics of domain names and traffic, obtain the total weight, and thus accurately determine the PCDN device.

[0044] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0045] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:

[0046] Figure 1 A flowchart illustrating a method for determining PCDN device users based on domain name behavior, provided in an embodiment of this application;

[0047] Figure 2 This is a schematic diagram of a PCDN device user determination device based on domain name behavior, provided in an embodiment of this application. Detailed Implementation

[0048] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this application, and should not be construed as limiting this application.

[0049] Content Delivery Networks (CDNs) primarily utilize edge node deployments and traffic load balancing and intelligent scheduling technologies to act as proxy servers between users and the accessing business servers, thereby accelerating user access speeds and reducing the load on business servers. Peer-to-Peer (P2PC) Content Delivery Networks (PCDNs) are a type of content delivery network based on Peer-to-Peer (P2P) technology. This technology extends traditional CDN technology by allowing users participating in the lower layers of the CDN to act as "mini-nodes" in content distribution. This further reduces the path taken by network users when requesting network resources from the CDN and even the origin server, resulting in faster resource acquisition speeds.

[0050] The unauthorized construction of PCDN networks brings numerous problems. Because PCDN construction requires specialized technical knowledge and effective organization and scheduling, it is often achieved through packaged electronic devices or software provided by relevant organizations. If unsuspecting users or malicious software use these packages to convert user-owned devices into PCDN nodes, it can lead to device misuse or information leakage, infringing on user rights. Secondly, PCDN is based on P2P technology. Given the characteristics of P2P, individuals do not monitor the content transmitted on their devices, and these devices are typically closed, lacking central management and oversight. This makes it impossible to monitor the resources flowing within the PCDN network, posing a security risk to network information content. Finally, as an effective CDN system, PCDN requires a stable, high-speed network and substantial uplink and downlink bandwidth resources. However, the home or business broadband sold by operators to individuals and organizations does not allow these services to use network resources, violating the purpose of broadband sales. If an organization integrates a large amount of such broadband resources, connects multiple PCDN devices to form CDN sites, and sells the service to other companies at low cost, it will seriously infringe on the actual interests of operators and constitutes a serious violation.

[0051] Related technologies use netflow traffic to identify abnormal users. The identification process mainly calculates the feature weight scores of various traffic types. The final domain name is mainly based on the interaction domains visited by historically identified suspicious PCDN users as PCDN domain characteristics. Subsequent suspicious users visiting the same domains further strengthen the weight of the user as a PCDN user. However, in reality, PCDN devices themselves access a large number of normal website domains or CDN node content to confirm their own status, network location, network quality, complete scheduling, and acquire resources. This makes it difficult to determine which domains can effectively restrict PCDN based on the output domain names. At the same time, uncertain suspicious interaction domain names may significantly reduce the final identification characteristics.

[0052] To address this issue, embodiments of this application provide a method for determining PCDN device users based on domain name behavior. Figure 1 This is a flowchart illustrating a method for determining PCDN device users based on domain name behavior, provided in an embodiment of this application. Figure 1 As shown, the method includes the following steps:

[0053] Step 101: Analyze the traffic during the operation of the Personal Content Delivery Network (PCDN) device to determine characteristic data, wherein the characteristic data includes: domain name characteristics, communication characteristics, and behavioral characteristics;

[0054] In this embodiment, by studying the operating principle of the PCDN box device, the domain name characteristics, communication characteristics, and behavioral characteristics of PCDN services are obtained, thereby improving the accuracy of mining PCDN users from DNS logs.

[0055] Step 102: Analyze the domain name to be identified in the DNS cache log of the device to be identified and the traffic data corresponding to the domain name to be identified based on the feature data to determine the total weight of the domain name to be identified;

[0056] Step 103: Determine whether the device to be identified is a PCDN device based on the total weight of the domain name to be identified.

[0057] This embodiment uses domain names as the main body to construct the domain names, communication and behavioral characteristics corresponding to the various business domain names of the corresponding PCDN platform. By discovering users who have accessed the same domain name and have similar behaviors in the DNS log, it is determined that PCDN devices are used and the PCDN platform used is known.

[0058] Optionally, step 101 involves analyzing the traffic flow during the operation of the PCDN device to determine characteristic data, including:

[0059] Search for domain names in the domain name registration records that are related to the group to which the PCDN device belongs;

[0060] Extract the feature words from the domain name to be analyzed, and combine the feature words to form the domain name features.

[0061] PCDN box devices generate a large number of domain name requests, including those for business updates, resource location, and resource acquisition, as well as domains belonging to legitimate websites. Therefore, the first step is to search for domains whose domain registration is consistent with or related to the group to which the device belongs. For example, the WanKeYun box belongs to Wangxin Cloud Company, so search for domains related to Wangxin Cloud in the box's mirror traffic. Secondly, although there are no strict rules for domain name naming, domains with similar business characteristics often exhibit similar behavior. For instance, domains containing keywords such as "xyajs.data", "speed.tesla", and "remotedl" frequently appear in Wangxin Cloud boxes, indicating a PCDN business relevance.

[0062] kuiniuca.com is a cloud domain under Xingyu Cloud, which is an edge cloud product of Wangxin Company. Data within the packet indicates that this domain handles data reporting, with upstream data significantly exceeding downstream data. The domain structure also shows similar domains such as isvip0xyajs-data.xycdn.com and sdk0xyajs.data.kuiniuca.com. Based on this, new domains like sdk2xyajs-data.xycdn.com and sdk0xyajs.data.p2cdn.com can be found in the DNS logs. It can be inferred that these domains may have similar functions to business domains in PCDN, which can be used for further auxiliary judgment and mining of PCDN business domains. The identified keywords are "xyajs.data", "speed.tesla", and "remotedl".

[0063] Optionally, step 101 involves analyzing the traffic flow during the operation of the PCDN device to determine characteristic data, including:

[0064] The corresponding communication service type is determined based on the traffic data corresponding to the domain name to be analyzed;

[0065] A first weight is configured for each of the communication service types, and the communication feature is formed based on the communication service type and the first weight.

[0066] In this embodiment, numerous services run within the PCDN box, including general domains used by the group rather than dedicated domains for the PCDN device's services. Therefore, it is necessary to confirm the communication behavior of these domains. Through mirrored traffic analysis, the URL content of HTTP packet requests and the content of sent JSON datagrams are examined. The roles of the service domains within the PCDN box are differentiated based on five aspects: communication heartbeats, data push, resource acquisition, service updates, and other functions, ranked from highest to lowest importance. Furthermore, the number of requests and request intervals for each domain are statistically analyzed. Combined with the importance of the domain representing the service, a weight is assigned to the domain's communication, ranging from 1 to 10, with 1 indicating low weight and 10 indicating high weight. Domains with frequent requests and high service importance have higher weights, and vice versa. Finally, a corresponding communication feature database is formed for different domains on different box devices.

[0067] For example, the domain speed.tesla.onethingpcs.com is primarily used as a host in the HTTP protocol, appearing at various times and receiving frequent requests, approximately once every 10-30 seconds. The aforementioned domain sdk1xyajs.data.kuiniuca.com receives requests within one minute. This indicates that domains with frequent requests on devices can be considered PCDN business domains and can be assigned high weight. The domain sm-gl.xycdn.com has no clear pattern in its request intervals and a low request frequency, but the request content contains resource address information, and subsequent traffic from PCDN devices also begins to retrieve data from this resource address. It is also an important business domain and can similarly be assigned high weight, categorized as a resource retrieval domain, thus increasing its importance.

[0068] Optionally, step 101 involves analyzing the traffic flow during the operation of the PCDN device to determine characteristic data, including:

[0069] Determine the behavior of the domain name to be analyzed by determining the traffic data corresponding to the domain name to be analyzed.

[0070] Each of the behaviors is assigned a corresponding second weight, and the behavior features are formed based on the second weight and the corresponding behavior.

[0071] In this embodiment, the frequency of communication between different business domain names varies, resulting in differences. Similarly, the request behavior of domain names between different boxes also differs, necessitating the construction of corresponding behavioral feature databases for different boxes and domain names. Through mirror traffic analysis of the box devices, the behavioral characteristics of the corresponding PCDN box domain names are statistically calculated from the perspectives of time, domain request type, and CNAME content. These characteristics include the domain request interval, frequency, requested resource type, whether a CNAME is requested, whether other domains have requested the same CNAME, and domains requesting the same CNAME. This information is used to construct the domain behavior and potential relationships. The aforementioned domain behavior characteristics are then matched against the behavior of PCDN box users in the actual DNS logs.

[0072] Optionally, the behavioral characteristics include at least one of the following:

[0073] Request interval, request frequency, requested resource type, request CNAME, number of domains for requesting CNAME.

[0074] Optionally, step 102 analyzes the domain name to be identified in the DNS cache log of the device to be identified and the traffic data corresponding to the domain name to be identified based on the feature data to determine the total weight of the domain name to be identified, including:

[0075] The domain name to be identified is matched with the feature words, and the domain name to be identified containing the feature words is determined as the domain name to be identified;

[0076] The pending domain name is analyzed based on communication characteristics to determine the communication service type and corresponding first weight of the pending domain name;

[0077] The traffic data of the domain name to be determined is analyzed based on behavioral characteristics to determine the behavior of the domain name to be determined and the corresponding second weight.

[0078] The behaviors are weighted according to the second weight and then summed, and the sum is multiplied by the first weight to obtain the total weight.

[0079] In this embodiment, after obtaining DNS cache logs and feature data, the domain names in the DNS cache logs and domain name features with similar characteristics are matched using PCDN domain name features.

[0080] The analysis weights of the corresponding domains are assigned from the communication behavior database. Since there are similar domains, the domains with similar characteristics will have their weights reduced by 1 from the weights of the similar domains in the communication behavior database (for example, if the domain isvip0xyajs.data.xycdn.com is a newly matched domain and is similar to the domain isvip0xyajs.data.kuiniuca.com in the database, then the weight of the similar domain will be the weight of the domain in the database minus 1).

[0081] By integrating user DNS log data and combining it with the PCDN box device behavior feature library, the behavior of corresponding domain names in the DNS is analyzed in the same way. Since similar domain names are not qualitative, only the behavior of request time interval and request quantity is analyzed as auxiliary features.

[0082] Potential PCDN users are identified by filtering users with similar PCDN service domain request behavior, high frequency of PCDN service domain requests, large number of requested PCDN service domains, and high weighted sum of domain name requests and request frequency. Furthermore, users with similar domain names whose requested domain name frequency and weighted sum are also high can be further identified as high-probability potential PCDN users, and these similar domain names can be updated in the feature behavior database. PCDN domain names requested by PCDN users can be considered key domain names for the business; by blocking these domain names and rate limiting the PCDN users, PCDN services can be blocked.

[0083] After matching the device's characteristic behavior database, relevant PCDN business domain names and structurally similar domain names can be filtered out (sd-gl.xycdn.com is a similar domain name to sm-gl.xycdn.com). The number of requests for each domain name and its corresponding weight are then calculated from the DNS logs. Finally, by weighted summation of the domain names, the overall weight of user requests to PCDN can be obtained.

[0084] The more domains a user requests, and the higher the weighted sum of the request volume and weight, the higher the likelihood that the user is a PCDN user; conversely, the lower the likelihood that the user is a PCDN user.

[0085] Optionally, step 103, determining whether the device to be identified is a PCDN device based on the total weight of the domain name to be identified, includes:

[0086] The total weight is compared with a preset weight threshold. If the total weight is greater than the weight threshold, the device to be identified is determined to be a PCDN device.

[0087] If the total weight is less than or equal to the weight threshold, then the device to be identified is determined not to be a PCDN device.

[0088] To implement the above embodiments, this application also proposes a PCDN device user determination device based on domain name behavior. Figure 2 This is a schematic diagram of a PCDN device user determination device based on domain name behavior, provided as an embodiment of this application. Figure 2 As shown, the device includes:

[0089] The feature acquisition module 210 is used to analyze the traffic during the operation of the PCDN device to determine feature data, wherein the feature data includes: domain name features, communication features, and behavioral features;

[0090] Analysis module 220 is used to analyze the domain name to be identified in the DNS cache log of the device to be identified and the traffic data corresponding to the domain name to be identified based on the feature data to determine the total weight of the domain name to be identified;

[0091] The identification module 230 is used to determine whether the device to be identified is a PCDN device based on the total weight of the domain name to be identified.

[0092] To implement the above embodiments, this application also proposes an electronic device, including: a processor and a memory communicatively connected to the processor; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory to implement the method provided in the foregoing embodiments.

[0093] To implement the above embodiments, this application also proposes a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the methods provided in the foregoing embodiments.

[0094] To implement the above embodiments, this application also proposes a computer program product, including a computer program that, when executed by a processor, implements the methods provided in the foregoing embodiments.

[0095] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in this application comply with relevant laws and regulations and do not violate public order and good morals.

[0096] It should be noted that personal information collected from users should be used for legitimate and reasonable purposes and should not be shared or sold outside of these legitimate uses. Furthermore, such collection / sharing should only be conducted after receiving the user's informed consent, including but not limited to notifying the user to read the user agreement / user notice and sign an agreement / authorization that includes authorization of relevant user information before the user uses the function. In addition, any necessary steps must be taken to protect and safeguard access to such personal information data and ensure that others with access to personal information data comply with their privacy policies and procedures.

[0097] This application is intended to provide an implementation scheme for users to selectively prevent the use or access to their personal information data. Specifically, this disclosure is intended to provide hardware and / or software to prevent or block access to such personal information data. Once personal information data is no longer needed, risks can be minimized by restricting data collection and deleting data. Furthermore, where applicable, such personal information is de-identified to protect user privacy.

[0098] In the foregoing descriptions of the embodiments, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0099] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "multiple" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0100] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0101] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0102] It should be understood that various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0103] Those skilled in the art will understand that all or part of the steps of the methods described in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it includes one or a combination of the steps of the method embodiments.

[0104] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0105] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of this application.

Claims

1. A method for determining PCDN device users based on domain name behavior, characterized in that, Includes the following steps: Analyzing traffic during the operation of a Personal Content Delivery Network (PCDN) device to determine characteristic data includes: determining the corresponding communication service type based on traffic data corresponding to the domain name to be analyzed; configuring a first weight for each of the communication service types; forming the communication characteristics based on the communication service type and the first weight; determining the behavior of the domain name to be analyzed based on traffic data corresponding to the domain name to be analyzed; configuring a corresponding second weight for each of the behaviors; forming the behavior characteristics based on the second weight and the corresponding behavior, wherein the characteristic data includes: domain name characteristics, communication characteristics, and behavior characteristics. The total weight of the domain to be identified is determined by analyzing the domain name in the DNS cache log of the device to be identified and the traffic data corresponding to the domain name. This includes: matching the domain name to be identified with feature words to identify domain names containing the feature words; analyzing the domain name to be identified based on communication features to determine the communication service type and corresponding first weight; analyzing the traffic data of the domain name to be identified based on behavioral features to determine the behavior and corresponding second weight; weighting the behavior according to the second weight and summing the results, and multiplying the sum by the first weight to obtain the total weight. The determination of whether the device to be identified is a PCDN device is based on the total weight of the domain name to be identified.

2. The method according to claim 1, characterized in that, The analysis of traffic flow during PCDN device operation to determine characteristic data includes: Search for domain names in the domain name registration records that are related to the group to which the PCDN device belongs; Extract the feature words from the domain name to be analyzed, and combine the feature words to form the domain name features.

3. The method according to claim 1, characterized in that, The behavioral characteristics include at least one of the following: Request interval, request frequency, requested resource type, request CNAME, number of domains for requesting CNAME.

4. The method according to claim 1, characterized in that, The step of determining whether the device to be identified is a PCDN device based on the total weight of the domain name to be identified includes: The total weight is compared with a preset weight threshold. If the total weight is greater than the weight threshold, the device to be identified is determined to be a PCDN device. If the total weight is less than or equal to the weight threshold, then the device to be identified is determined not to be a PCDN device.

5. A PCDN device user determination device based on domain name behavior, characterized in that, The PCDN device user determination method based on domain name behavior according to any one of claims 1-4 includes: The feature acquisition module is used to analyze the traffic during the operation of the PCDN device to determine feature data, wherein the feature data includes: domain name features, communication features, and behavioral features; The analysis module is used to analyze the domain name to be identified in the DNS cache log of the device to be identified and the traffic data corresponding to the domain name to be identified based on the feature data to determine the total weight of the domain name to be identified. The identification module is used to determine whether the device to be identified is a PCDN device based on the total weight of the domain name to be identified.

6. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1-4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-4.

Images