A subdomain blasting method, device, equipment and storage medium

Abstract

The present application provides a subdomain blasting method, device, equipment and storage medium, which are used to solve the problem of low flexibility of subdomain blasting. The method at least includes: obtaining multiple reference subdomains of the main domain name to be blasted; selecting matching target subdomain sets for the multiple reference subdomains from the pre-stored multiple candidate subdomain sets; wherein the candidate subdomains in each of the candidate subdomain sets are subdomains enabled within the historical time; the similarity between the candidate subdomains in different candidate subdomain sets is less than the first similarity threshold; the similarity between the candidate subdomains in the same candidate subdomain set is greater than the second similarity threshold; respectively, from each of the obtained target subdomain sets, selecting multiple target subdomains with similarity greater than the third similarity threshold for the corresponding reference subdomains; based on each of the obtained target subdomains, performing subdomain blasting on the main domain name to be blasted to obtain a subdomain blasting result.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a subdomain blasting method, device, equipment and storage medium. Background Art

[0002] With the continuous development of technology, more and more devices can identify possible security vulnerabilities in the field of network security by inferring and identifying potential subdomains under the target domain name, that is, through subdomain blasting. Subdomain blasting is of great significance for vulnerability assessment, network attack simulation, and malicious activity detection.

[0003] In the related art, the method of subdomain blasting is usually to pre-set a large-scale subdomain dictionary, and determine the potential subdomains under the target domain name through exhaustive search, so that subdomain blasting can be performed based on the searched subdomains to obtain subdomain blasting results.

[0004] However, the subdomain dictionary is usually set by entering the subdomains in sequence. Therefore, not only is it easy to make mistakes during the entry process, resulting in low accuracy of the subdomain dictionary, but also the richness of the subdomains in the subdomain dictionary depends entirely on the entry process, so it is easy to have inaccurate subdomain blasting.

[0005] Furthermore, since the subdomain dictionary contains a large number of subdomains, the method of determining the potential subdomains under the target domain name through exhaustive search requires a large amount of computing resources, making subdomain blasting time-consuming and inefficient.

[0006] It can be seen that under the relevant technology, the accuracy and efficiency of subdomain blasting are too dependent on the preset subdomain dictionary, which makes the flexibility of subdomain blasting low. Summary of the invention

[0007] The embodiments of the present application provide a subdomain blasting method, apparatus, device and storage medium, which are used to solve the problem of low flexibility of subdomain blasting.

[0008] In a first aspect, a subdomain blasting method is provided, comprising:

[0009] Acquire multiple reference subdomains of the main domain to be blasted; wherein the reference subdomains are: subdomains that are activated in the historical time and include the main domain to be blasted;

[0010] Selecting matching target subdomain sets for the multiple reference subdomains from the pre-stored multiple candidate subdomain sets respectively; wherein the candidate subdomains in each of the candidate subdomain sets are subdomains activated within the historical time; the similarity between the candidate subdomains in different candidate subdomain sets is less than a first similarity threshold; and the similarity between the candidate subdomains in the same candidate subdomain set is greater than a second similarity threshold;

[0011] Selecting, from each of the obtained target subdomain sets, a plurality of target subdomains having similarities greater than a third similarity threshold for the corresponding reference subdomains;

[0012] Based on each obtained target subdomain, subdomain blasting is performed on the main domain to be blasted to obtain a subdomain blasting result.

[0013] Optionally, the step of obtaining multiple reference subdomains of the main domain name to be blasted includes:

[0014] Get the object to be blasted;

[0015] Determining the to-be-blasted main domain name of the to-be-blasted object based on the first mapping relationship between each reference object and each preset main domain name;

[0016] Based on the second mapping relationship between each preset main domain name and each historical subdomain name set, determine the historical subdomain name set of the main domain name to be blasted; wherein the second mapping relationship indicates that: the historical subdomain name in the historical subdomain name set contains the corresponding preset main domain name and is enabled within the historical time;

[0017] Select multiple reference subdomains from the obtained historical subdomain set.

[0018] Optionally, the multiple candidate subdomain name sets are obtained by using the following method:

[0019] Get the historical subdomain sets of multiple preset main domains;

[0020] For each obtained historical subdomain name set, respectively perform: extract prefix features of each historical subdomain name included in the historical subdomain name set to obtain corresponding prefix features;

[0021] Based on the obtained prefix features, similar subdomains are clustered for the historical subdomain sets to obtain the multiple candidate subdomain sets; wherein each candidate subdomain contained in each candidate subdomain set comes from at least one historical subdomain set.

[0022] Optionally, the prefix feature extraction is implemented by using a trained target feature extraction model, and the target feature extraction model is trained by the following method:

[0023] Based on the multiple preset main domain names and the historical subdomain name sets, the feature extraction model to be trained is trained for multiple rounds of iterations to output a trained target feature extraction model; wherein each round of iterations includes:

[0024] Extracting character features from the subdomain name prefixes of each historical subdomain name included in the historical subdomain name set of the preset main domain name, respectively, to obtain character features of the subdomain name prefixes of each historical subdomain name;

[0025] Mapping each character feature obtained into a primary domain name training feature of the preset primary domain name;

[0026] Based on the difference between the obtained primary domain name training features and the primary domain name sample features extracted from the preset primary domain name, the model parameters of the feature extraction model are adjusted.

[0027] Optionally, the feature extraction model includes a character feature extraction network, and the character feature extraction network is used to extract character features. The character feature extraction network is trained using the following method:

[0028] For each of the historical subdomain sets, perform the following operations respectively:

[0029] Extracting character features from the subdomain prefixes of each historical subdomain included in the historical subdomain set to obtain a corresponding character feature sequence;

[0030] Performing character masking on each obtained character feature sequence to obtain a corresponding masked feature sequence, and performing character prediction on each obtained masked feature sequence to obtain a corresponding predicted character sequence;

[0031] Based on the differences between each of the obtained predicted character sequences and the subdomain prefix of the corresponding historical subdomain, the network parameters of the character feature extraction network are adjusted.

[0032] Optionally, performing character masking on each obtained character feature sequence to obtain a corresponding masked feature sequence, and performing character prediction on each obtained masked feature sequence to obtain a corresponding predicted character sequence, includes:

[0033] Sliding segmentation is performed on each character feature sequence obtained with a preset feature length to obtain a feature subsequence set corresponding to each character feature sequence; wherein each feature subsequence is used to describe the feature of a prefix segment in the subdomain prefix of the corresponding historical subdomain; each prefix segment contains multiple characters in the corresponding subdomain prefix;

[0034] For each obtained feature subsequence set, respectively performing: respectively covering a feature element corresponding to at least one character in each feature subsequence contained in the feature subsequence set, and taking each obtained covered subsequence as a covered feature sequence;

[0035] For each obtained mask feature sequence, respectively perform the following steps: respectively perform character prediction on each mask cap sequence in the mask feature sequence, and use each obtained predicted character segment as a predicted character sequence.

[0036] Optionally, mapping the obtained character features into primary domain name training features of the preset primary domain name includes:

[0037] A feature matrix established based on each character feature obtained is subjected to nonlinear transformation to obtain an associated weight vector; wherein each vector element in the associated weight vector represents: the degree of association between each historical subdomain name included in the historical subdomain name set of the preset main domain name and the preset main domain name;

[0038] The vector elements included in the association weight vector are used as weights, and the character features are integrated to obtain the primary domain name training features of the preset primary domain name.

[0039] Optionally, adjusting the model parameters of the feature extraction model based on the difference between the obtained primary domain name training features and the primary domain name sample features extracted from the preset primary domain name includes:

[0040] The obtained main domain name training feature is concatenated with the character feature of a historical subdomain name in the historical subdomain name set of the preset main domain name to obtain a concatenated feature;

[0041] Perform domain name prediction on the obtained splicing features to obtain domain name prediction results;

[0042] Based on the difference between the obtained main domain name training features and the main domain name sample features extracted from the sample main domain name, and the difference between the obtained domain name prediction result and the subdomain name prefix of the one historical subdomain name, the model parameters of the feature extraction model are adjusted.

[0043] Optionally, the feature extraction model further includes a feature comparison network, and the feature comparison network is used to adjust model parameters of the feature extraction model;

[0044] Then, adjusting the model parameters of the feature extraction model based on the difference between the obtained primary domain name training features and the primary domain name sample features extracted from the preset primary domain name includes:

[0045] Based on the number of primary domain names of the preset primary domain names, similar characters are clustered for the character features to obtain a plurality of clusters;

[0046] Based on the distance between the primary domain training feature and the respective cluster centers of the multiple clusters, and the difference between the obtained primary domain training feature and the primary domain sample feature extracted from the preset primary domain, the model parameters of the feature extraction model are adjusted.

[0047] Optionally, adjusting the model parameters of the feature extraction model based on the distance between the primary domain name training feature and the respective cluster centers of the multiple clusters, and the difference between the obtained primary domain name training feature and the primary domain name sample feature extracted from the preset primary domain name, includes:

[0048] Adjusting model parameters of the feature extraction model based on at least two of the following training objectives:

[0049] The minimum distance between the main domain name training feature and the cluster centers of the plurality of clusters is less than a first distance threshold;

[0050] The distances between the cluster centers other than the cluster center corresponding to the minimum distance are greater than a second distance threshold;

[0051] The difference between the obtained main domain name training feature and the main domain name sample feature extracted from the preset main domain name is less than a preset difference threshold.

[0052] Optionally, selecting matching target subdomain sets for the multiple reference subdomains from the pre-stored multiple candidate subdomain sets respectively includes:

[0053] For the plurality of candidate subdomain sets, respectively performing: fusing prefix features extracted from the subdomain prefixes of the candidate subdomains in the candidate subdomain set to obtain set features of the candidate subdomain set;

[0054] For the multiple reference subdomains, perform the following operations respectively:

[0055] Based on the prefix features extracted from the reference subdomain and the obtained set features, respectively determine the matching degree between the reference subdomain and the plurality of candidate subdomain sets;

[0056] From the plurality of candidate subdomain name sets, a target subdomain name set having a matching degree greater than a matching degree threshold is selected.

[0057] Optionally, based on each obtained target subdomain, performing subdomain blasting on the main domain to be blasted to obtain the subdomain blasting result includes:

[0058] From the obtained target subdomains, select multiple recommended subdomains whose relevance to the main domain to be blasted meets the association condition;

[0059] Based on the obtained multiple recommended subdomains, subdomain blasting is performed on the main domain to be blasted to obtain a subdomain blasting result.

[0060] Optionally, selecting from the obtained target subdomains a plurality of recommended subdomains whose relevance to the main domain to be blasted satisfies an association condition includes:

[0061] For each obtained target subdomain, respectively: integrating the similarities between the multiple reference subdomains and the main domain to be blasted, and the similarities between the target subdomain and the multiple reference subdomains, to determine the correlation between the target subdomain and the main domain to be blasted;

[0062] Based on the obtained relevances, a plurality of recommended subdomains having relevances greater than a preset relevance threshold are selected from the target subdomains.

[0063] In a second aspect, a subdomain blasting device is provided, comprising:

[0064] Acquisition module: used to acquire multiple reference subdomains of the main domain to be blasted; wherein the reference subdomains are: subdomains that are activated in the historical time and include the main domain to be blasted;

[0065] Processing module: used to select matching target subdomain sets for the multiple reference subdomains from the pre-stored multiple candidate subdomain sets; wherein the candidate subdomains in each of the candidate subdomain sets are subdomains activated within the historical time; the similarity between the candidate subdomains in different candidate subdomain sets is less than a first similarity threshold; the similarity between the candidate subdomains in the same candidate subdomain set is greater than a second similarity threshold;

[0066] The processing module is further used to: respectively select a plurality of target subdomains having a similarity greater than a third similarity threshold for the corresponding reference subdomains from each of the obtained target subdomain sets;

[0067] The processing module is further used to: perform subdomain blasting on the main domain name to be blasted based on each obtained target subdomain name, and obtain a subdomain blasting result.

[0068] Optionally, the acquisition module is specifically used for:

[0069] Get the object to be blasted;

[0070] Determining the to-be-blasted main domain name of the to-be-blasted object based on the first mapping relationship between each reference object and each preset main domain name;

[0071] Based on the second mapping relationship between each preset main domain name and each historical subdomain name set, determine the historical subdomain name set of the main domain name to be blasted; wherein the second mapping relationship indicates that: the historical subdomain name in the historical subdomain name set contains the corresponding preset main domain name and is enabled within the historical time;

[0072] Select multiple reference subdomains from the obtained historical subdomain set.

[0073] Optionally, the processing module is further used for:

[0074] Get the historical subdomain sets of multiple preset main domains;

[0075] For each obtained historical subdomain name set, respectively perform: extract prefix features of each historical subdomain name included in the historical subdomain name set to obtain corresponding prefix features;

[0076] Based on the obtained prefix features, similar subdomains are clustered for the historical subdomain sets to obtain the multiple candidate subdomain sets; wherein each candidate subdomain contained in each candidate subdomain set comes from at least one historical subdomain set.

[0077] Optionally, the prefix feature extraction is implemented by using a trained target feature extraction model, the target feature extraction model is trained by the following method, and the processing module is specifically used for:

[0078] Based on the multiple preset main domain names and the historical subdomain name sets, the feature extraction model to be trained is trained for multiple rounds of iterations to output a trained target feature extraction model; wherein each round of iterations includes:

[0079] Extracting character features from the subdomain name prefixes of each historical subdomain name included in the historical subdomain name set of the preset main domain name, respectively, to obtain character features of the subdomain name prefixes of each historical subdomain name;

[0080] Mapping each character feature obtained into a primary domain name training feature of the preset primary domain name;

[0081] Based on the difference between the obtained primary domain name training features and the primary domain name sample features extracted from the preset primary domain name, the model parameters of the feature extraction model are adjusted.

[0082] Optionally, the feature extraction model includes a character feature extraction network, the character feature extraction network is used to extract character features, the character feature extraction network is trained using the following method, and the processing module is specifically used for:

[0083] For each of the historical subdomain sets, perform the following operations respectively:

[0084] Extracting character features from the subdomain prefixes of each historical subdomain included in the historical subdomain set to obtain a corresponding character feature sequence;

[0085] Performing character masking on each obtained character feature sequence to obtain a corresponding masked feature sequence, and performing character prediction on each obtained masked feature sequence to obtain a corresponding predicted character sequence;

[0086] Based on the differences between each of the obtained predicted character sequences and the subdomain prefix of the corresponding historical subdomain, the network parameters of the character feature extraction network are adjusted.

[0087] Optionally, the processing module is specifically used for:

[0088] Sliding segmentation is performed on each character feature sequence obtained with a preset feature length to obtain a feature subsequence set corresponding to each character feature sequence; wherein each feature subsequence is used to describe the feature of a prefix segment in the subdomain prefix of the corresponding historical subdomain; each prefix segment contains multiple characters in the corresponding subdomain prefix;

[0089] For each obtained feature subsequence set, respectively performing: respectively covering a feature element corresponding to at least one character in each feature subsequence contained in the feature subsequence set, and taking each obtained covered subsequence as a covered feature sequence;

[0090] For each obtained mask feature sequence, respectively perform the following steps: respectively perform character prediction on each mask cap sequence in the mask feature sequence, and use each obtained predicted character segment as a predicted character sequence.

[0091] Optionally, the processing module is specifically used for:

[0092] A feature matrix established based on each character feature obtained is subjected to nonlinear transformation to obtain an associated weight vector; wherein each vector element in the associated weight vector represents: the degree of association between each historical subdomain name included in the historical subdomain name set of the preset main domain name and the preset main domain name;

[0093] The vector elements included in the association weight vector are used as weights, and the character features are integrated to obtain the primary domain name training features of the preset primary domain name.

[0094] Optionally, the processing module is specifically used for:

[0095] The obtained main domain name training feature is concatenated with the character feature of a historical subdomain name in the historical subdomain name set of the preset main domain name to obtain a concatenated feature;

[0096] Perform domain name prediction on the obtained splicing features to obtain domain name prediction results;

[0097] Based on the difference between the obtained main domain name training features and the main domain name sample features extracted from the sample main domain name, and the difference between the obtained domain name prediction result and the subdomain name prefix of the one historical subdomain name, the model parameters of the feature extraction model are adjusted.

[0098] Optionally, the feature extraction model further includes a feature comparison network, and the feature comparison network is used to adjust model parameters of the feature extraction model;

[0099] Then the processing module is specifically used for:

[0100] Based on the number of primary domain names of the preset primary domain names, similar characters are clustered for the character features to obtain a plurality of clusters;

[0101] Based on the distance between the primary domain training feature and the respective cluster centers of the multiple clusters, and the difference between the obtained primary domain training feature and the primary domain sample feature extracted from the preset primary domain, the model parameters of the feature extraction model are adjusted.

[0102] Optionally, the processing module is specifically used for:

[0103] Adjusting model parameters of the feature extraction model based on at least two of the following training objectives:

[0104] The minimum distance between the main domain name training feature and the cluster centers of the plurality of clusters is less than a first distance threshold;

[0105] The distances between the cluster centers other than the cluster center corresponding to the minimum distance are greater than a second distance threshold;

[0106] The difference between the obtained main domain name training feature and the main domain name sample feature extracted from the preset main domain name is less than a preset difference threshold.

[0107] Optionally, the processing module is specifically used for:

[0108] For the plurality of candidate subdomain sets, respectively performing: fusing prefix features extracted from the subdomain prefixes of the candidate subdomains in the candidate subdomain set to obtain set features of the candidate subdomain set;

[0109] For the multiple reference subdomains, perform the following operations respectively:

[0110] Based on the prefix features extracted from the reference subdomain and the obtained set features, respectively determine the matching degree between the reference subdomain and the plurality of candidate subdomain sets;

[0111] From the plurality of candidate subdomain name sets, a target subdomain name set having a matching degree greater than a matching degree threshold is selected.

[0112] Optionally, the processing module is specifically used for:

[0113] From the obtained target subdomains, select multiple recommended subdomains whose relevance to the main domain to be blasted meets the association condition;

[0114] Based on the obtained multiple recommended subdomains, subdomain blasting is performed on the main domain to be blasted to obtain a subdomain blasting result.

[0115] Optionally, the processing module is specifically used for:

[0116] For each obtained target subdomain, respectively: integrating the similarities between the multiple reference subdomains and the main domain to be blasted, and the similarities between the target subdomain and the multiple reference subdomains, to determine the correlation between the target subdomain and the main domain to be blasted;

[0117] Based on the obtained relevances, a plurality of recommended subdomains having relevances greater than a preset relevance threshold are selected from the target subdomains.

[0118] According to a third aspect, a computer program product is provided, comprising a computer program, which implements the method according to the first aspect when executed by a processor.

[0119] According to a fourth aspect, a computer device is provided, comprising:

[0120] A memory for storing program instructions;

[0121] The processor is used to call the program instructions stored in the memory and execute the method as described in the first aspect according to the obtained program instructions.

[0122] According to a fifth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable a computer to execute the method described in the first aspect.

[0123] In the embodiment of the present application, based on multiple reference subdomains including the main domain name to be blasted that have been enabled in the historical time, each target subdomain is automatically selected for the main domain name to be blasted for subdomain blasting, without the need to set up an additional subdomain dictionary, thereby improving the flexibility of subdomain blasting.

[0124] Furthermore, by selecting the target subdomain from the candidate subdomains enabled in the historical time, the commonly used character combinations can be used as the basis for selecting the target subdomain to a certain extent, rather than selecting the target subdomain from many uncommon character combinations, thereby improving the selection accuracy and efficiency, thereby improving the flexibility of subdomain blasting.

[0125] Furthermore, by selecting a matching target subdomain set for each reference subdomain, the selection range can be further narrowed down in commonly used character combinations. Based on multiple reference subdomains related to the main domain name to be blasted, the commonly used character combinations can be narrowed down to character combinations related to the main domain name to be blasted, thereby further improving the selection accuracy and efficiency, thereby further improving the flexibility of subdomain blasting.

[0126] Furthermore, after obtaining the target subdomain name sets corresponding to the multiple reference subdomain names, the target subdomain names whose similarity with the corresponding reference subdomain names is greater than the third similarity threshold can be selected from each target subdomain name set, thereby determining the target subdomain name that is most likely to be a subdomain name of the main domain name to be blasted from the character combinations that are related to and commonly used in the main domain name to be blasted, further improving the selection accuracy, thereby further improving the flexibility of subdomain blasting. BRIEF DESCRIPTION OF THE DRAWINGS

[0127] Figure 1 An application scenario of the subdomain blasting method provided in the embodiment of the present application;

[0128] Figure 2 A schematic diagram of a flow chart of a subdomain blasting method provided in an embodiment of the present application;

[0129] Figure 3 A schematic diagram of the principle of the subdomain blasting method provided in the embodiment of the present application Figure 1 ;

[0130] Figure 4 A schematic diagram of the principle of the subdomain blasting method provided in the embodiment of the present application Figure 2 ;

[0131] Figure 5 A schematic diagram of the principle of the subdomain blasting method provided in the embodiment of the present application Figure 3 ;

[0132] Figure 6 A schematic diagram of the principle of the subdomain blasting method provided in the embodiment of the present application Figure 4 ;

[0133] Figure 7 A schematic diagram of the principle of the subdomain blasting method provided in the embodiment of the present application Figure 5 ;

[0134] Figure 8 A schematic diagram of a subdomain blasting device provided in an embodiment of the present application Figure 1 ;

[0135] Fig. 9 A schematic diagram of a subdomain blasting device provided in an embodiment of the present application Figure 2 . DETAILED DESCRIPTION

[0136] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0137] Some of the terms used in the embodiments of the present application are explained below to facilitate understanding by those skilled in the art.

[0138] (1) Primary Domain Name:

[0139] The primary domain name is also often called the primary website domain name. It refers to the domain name that an organization, company or individual uses most in its Internet presence. It is the highest-level name used to identify a website or a group of related websites, and is usually the core part of an organization's official website address.

[0140] (2) Subdomain:

[0141] A subdomain is a part of a main domain, usually used to represent different sections or functional areas within a website. Subdomains are formed by adding additional tags to the main domain. It can help organize the content structure of the website, and also help with search engine optimization (SEO), etc.

[0142] It should be noted that in the embodiments of the present application, operations involving obtaining data such as the main domain name to be blasted or the candidate subdomain name set are involved. When the above embodiments of the present application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0143] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program that has a predetermined function and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories), or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the function of the module or unit.

[0144] The following is a brief introduction to the application fields of the subdomain blasting method provided in the embodiments of the present application.

[0145] With the continuous development of technology, more and more devices can identify possible security vulnerabilities in the field of network security by inferring and identifying potential subdomains under the target domain name, that is, through subdomain blasting. Subdomain blasting is of great significance for vulnerability assessment, network attack simulation, and malicious activity detection.

[0146] In the related art, the method of subdomain blasting is usually to pre-set a large-scale subdomain dictionary, and determine the potential subdomains under the target domain name through exhaustive search, so that subdomain blasting can be performed based on the searched subdomains to obtain subdomain blasting results.

[0147] However, the subdomain dictionary is usually set up by entering the subdomains in sequence. Therefore, not only is it easy to make input errors during the input process, such as incorrect character input, repeated input, etc., but it also leads to the problem of low accuracy of the subdomain dictionary.

[0148] Moreover, the richness of the subdomains in the subdomain dictionary depends entirely on the input process. For example, when the input personnel have less experience, the subdomains entered into the subdomain dictionary will be fewer. For another example, when the input personnel's experience is limited to a certain scenario, the coverage of the subdomains entered into the subdomain dictionary will be narrower, etc., which will easily lead to inaccurate subdomain blasting problems.

[0149] Furthermore, since the subdomain dictionary contains a large number of subdomains, the method of determining the potential subdomains under the target domain name through exhaustive search requires a large amount of computing resources, making subdomain blasting time-consuming and inefficient.

[0150] It can be seen that under the relevant technology, the accuracy and efficiency of subdomain blasting are too dependent on the preset subdomain dictionary, which makes the flexibility of subdomain blasting low.

[0151] In order to solve the problem of low flexibility of subdomain blasting, the present application proposes a subdomain blasting method. In this method, multiple reference subdomains of the main domain name to be blasted are obtained, and the reference subdomains are: subdomains that are enabled in the historical time and contain the main domain name to be blasted. From the pre-stored multiple candidate subdomain sets, a matching target subdomain set is selected for the multiple reference subdomains. The candidate subdomains in each of the candidate subdomain sets are subdomains enabled in the historical time. The similarity between the candidate subdomains in different candidate subdomain sets is less than the first similarity threshold. The similarity between the candidate subdomains in the same candidate subdomain set is greater than the second similarity threshold. From each of the obtained target subdomain sets, multiple target subdomains with a similarity greater than the third similarity threshold are selected for the corresponding reference subdomains. Based on the obtained target subdomains, the main domain name to be blasted is subdomain blasted to obtain a subdomain blasting result.

[0152] In the embodiment of the present application, based on multiple reference subdomains including the main domain name to be blasted that have been enabled in the historical time, each target subdomain is automatically selected for the main domain name to be blasted for subdomain blasting, without the need to set up an additional subdomain dictionary, thereby improving the flexibility of subdomain blasting.

[0153] Furthermore, by selecting the target subdomain from the candidate subdomains enabled in the historical time, the commonly used character combinations can be used as the basis for selecting the target subdomain to a certain extent, rather than selecting the target subdomain from many uncommon character combinations. The co-occurrence of characters is used to improve the selection accuracy and efficiency, thereby improving the flexibility of subdomain blasting.

[0154] Furthermore, a matching target subdomain set is selected for each reference subdomain, and the selection range can be further narrowed in the commonly used character combinations. Based on multiple reference subdomains related to the main domain name to be blasted, the commonly used character combinations are narrowed to the character combinations related to the main domain name to be blasted. By utilizing the connectivity between the main domain name and the subdomain name, the selection accuracy and efficiency are further improved, thereby further improving the flexibility of subdomain blasting.

[0155] Furthermore, after obtaining the target subdomain name sets corresponding to the multiple reference subdomain names, the target subdomain names whose similarity with the corresponding reference subdomain names is greater than the third similarity threshold can be selected from each target subdomain name set, thereby determining the target subdomain name that is most likely to be a subdomain name of the main domain name to be blasted from the character combinations that are related to and commonly used in the main domain name to be blasted, further improving the selection accuracy, thereby further improving the flexibility of subdomain blasting.

[0156] The following is an explanation of the application scenarios of the subdomain blasting method provided in this application.

[0157] Please refer to Figure 1 , which is a schematic diagram of an application scenario of the subdomain blasting method provided in this application. The application scenario includes a server 101 and a client 102, and the server 101 and the client 102 can communicate with each other, and the communication method can be to use wired communication technology for communication, for example, by connecting a network cable or a serial port line for communication; or to use wireless communication technology for communication, for example, by using Bluetooth or wireless fidelity (wireless fidelity, WIFI) and other technologies for communication, and there is no specific limitation.

[0158] The client 102 generally refers to a device that can instruct to perform subdomain blasting on the main domain name to be blasted, such as a terminal device, a third-party application program accessible to the terminal device, or a web page accessible to the terminal device, etc. The server 101 generally refers to a device that can perform subdomain blasting, such as a terminal device or a server, etc.

[0159] Terminal devices include but are not limited to mobile phones, computers, smart medical devices, smart home appliances, vehicle-mounted terminals or aircraft, etc. Servers include but are not limited to cloud servers, local servers or associated third-party servers, etc. Both the client 102 and the server 101 can use cloud computing to reduce the occupation of local computing resources; cloud storage can also be used to reduce the occupation of local storage resources.

[0160] As an embodiment, the server 101 and the client 102 may be the same device, or may be different devices, or may be different devices with some modules in common, etc., without specific limitation.

[0161] The client 102 obtains the main domain name to be blasted in response to the input operation for the main domain name to be blasted. The client 102 sends a subdomain blasting request carrying the main domain name to be blasted to the server 101. After receiving the subdomain blasting request sent by the client 102, the server 101 obtains multiple reference subdomains of the main domain name to be blasted based on the main domain name to be blasted, and selects each target subdomain based on the multiple reference subdomains to perform subdomain blasting on the main domain name to be blasted, and obtains the subdomain blasting result. The server 101 returns the subdomain blasting result to the client 102, and the client 102 receives and presents the subdomain blasting result returned by the server 101.

[0162] The client 102 can also obtain multiple reference subdomains of the main domain name to be blasted based on the main domain name to be blasted after inputting the main domain name to be blasted, and select each target subdomain based on the multiple reference subdomains to perform subdomain blasting on the main domain name to be blasted, and obtain and present the subdomain blasting result.

[0163] The following is based on Figure 1, the subdomain blasting method provided in the embodiment of this application is specifically introduced. Please refer to Figure 2 , which is a flow chart of the subdomain blasting method provided in an embodiment of the present application.

[0164] S201, obtaining multiple reference subdomains of the main domain name to be blasted.

[0165] The reference subdomains are subdomains that are activated in the past and include the main domain to be blasted. These multiple reference subdomains are usually only part of the subdomains associated with the main domain to be blasted. They may have been deactivated or may still be in use. There is no specific restriction. Through the part of the subdomains associated with the main domain to be blasted, the real connectivity between the main domain to be blasted and the subdomains can be reflected, so that other subdomains can be selected for the main domain to be blasted more accurately, so as to carry out more comprehensive subdomain blasting.

[0166] As an embodiment, there are multiple ways to obtain multiple reference subdomains of the main domain name to be blasted. Two methods are described below as examples.

[0167] Method 1: Every time a subdomain is enabled, the enabled subdomain and its associated main domain are recorded, so that when the main domain to be blasted is obtained, the subdomains associated with the main domain to be blasted can be queried from the record.

[0168] Method 2: Obtain the first mapping relationship and the second mapping relationship from other devices. The first mapping relationship represents: the corresponding relationship between the reference object and the preset main domain name. The second mapping relationship represents: the historical subdomain name in the historical subdomain name set contains the corresponding preset main domain name and is enabled in the historical time. Then, the object to be blasted can be obtained. After obtaining the object to be blasted, the main domain name to be blasted of the object to be blasted is determined based on the first mapping relationship between each reference object and each preset main domain name. Based on the second mapping relationship between each preset main domain name and each historical subdomain name set, the historical subdomain name set of the main domain name to be blasted is determined. From the obtained historical subdomain name set, multiple reference subdomain names are selected. Selecting multiple reference subdomain names from the obtained historical subdomain name set can be randomly selected according to a preset number, or multiple reference subdomain names closest to the current time can be selected according to the activation time and the preset number, or multiple reference subdomain names with the longest duration can be selected according to the usage time and the preset number, etc., without specific restrictions.

[0169] Please refer to Figure 3 The first mapping relationship is stored in the Internet Content Provider (ICP) database, and the second mapping relationship is stored in the Domain Name System (DNS) database. The target to be blasted can be a company name, unit name, etc., without specific restrictions.

[0170] The DNS database can record domain name resolution records, including historical usage records of subdomain names. If the server is an operator, Internet Service Provider (ISP), or a company specializing in network security and domain name monitoring, the server can directly query relevant data from the DNS database associated with the server.

[0171] The object to be blasted may be obtained in response to an input operation, may be selected from an object list, may be extracted from an image, etc., without limitation. For example, the name of the enterprise may be obtained from registration information disclosed in network resources, enterprise homepages, industry reports, news reports, and other sources.

[0172] The server can send a primary domain name acquisition instruction carrying the object to be blasted to the ICP database, which is used to instruct the ICP database to return the primary domain name to be blasted of the object to be blasted. After receiving the primary domain name acquisition instruction, the ICP database searches for the corresponding primary domain name to be blasted from the first mapping relationship based on the object to be blasted, and returns the primary domain name to be blasted to the server.

[0173] After the server obtains the main domain name to be blasted returned by the ICP database, it sends a subdomain acquisition instruction carrying the main domain name to be blasted to the DNS database, which is used to instruct the DNS database to return the historical subdomains used by the main domain name to be blasted in the historical time, that is, the historical subdomain set. After receiving the subdomain acquisition instruction, the DNS database finds the corresponding historical subdomain set from the second mapping relationship based on the main domain name to be blasted, and returns the historical subdomain set to the server.

[0174] S202: Select matching target subdomain sets for multiple reference subdomains from multiple pre-stored candidate subdomain sets.

[0175] After obtaining multiple reference subdomains of the main domain to be blasted, matching target subdomain sets can be selected for the multiple reference subdomains from the pre-stored multiple candidate subdomain sets to obtain target subdomain sets corresponding to the multiple reference subdomains.

[0176] The candidate subdomains in each of the multiple candidate subdomain sets are subdomains activated in the historical time. The subdomains can be subdomains associated with the main domain to be blasted, or subdomains associated with other main domains, without specific restrictions. Through the subdomains activated in the historical time, the co-occurrence of each character in the prefix of each candidate subdomain in the target subdomain set matching the reference subdomain can be obtained, such as which characters have a higher probability of co-occurring, which characters have a lower probability of co-occurring, etc. Therefore, the target subdomain can be selected more accurately for the main domain to be blasted.

[0177] Among the multiple candidate subdomain sets, the similarity between the candidate subdomains in different candidate subdomain sets is less than the first similarity threshold. The similarity between the candidate subdomains in the same candidate subdomain set is greater than the second similarity threshold. If the first similarity threshold is less than the second similarity threshold, then the candidate subdomains in the same candidate subdomain set are as similar as possible, and the candidate subdomains in different candidate subdomain sets are as different as possible, so that the target subdomain sets selected for different reference subdomains have their own characteristics, thereby improving the richness of the selected target subdomains.

[0178] As an embodiment, there are many methods for obtaining multiple candidate subdomain sets. For example, an open source text feature extraction model is directly used to extract the domain name features of each candidate subdomain, and then similar features are clustered for each candidate subdomain based on the obtained domain name features. For another example, a target feature extraction model is trained based on the collected preset main domain names and their corresponding historical subdomain name sets, and prefix features of the subdomain prefix of each historical subdomain are extracted. Then, similar subdomains are clustered for each historical subdomain based on the obtained prefix features, etc.

[0179] The second acquisition method mentioned above is introduced in detail below.

[0180] Obtain the respective historical subdomain name sets of multiple preset main domain names. The method for obtaining the multiple preset main domain names and their respective historical subdomain name sets can refer to the method for obtaining the main domain name to be blasted and its historical subdomain name set introduced above, which will not be repeated here.

[0181] For each historical subdomain set obtained, respectively perform: extract prefix features for each historical subdomain contained in the historical subdomain set to obtain corresponding prefix features. The prefix feature is used to describe the features of the subdomain prefix of the corresponding historical subdomain. For example, for the subdomain abc.example.com, abc is the subdomain prefix, example is the corresponding primary domain, and com is the corresponding top-level domain.

[0182] Based on the obtained prefix features, each historical subdomain set is clustered into similar subdomains to obtain multiple candidate subdomain sets. Each candidate subdomain set contains candidate subdomains from at least one historical subdomain set. Through similar subdomain clustering, each historical subdomain set can be re-divided based on the similarity between subdomains to obtain multiple candidate subdomain sets.

[0183] As an embodiment, prefix feature extraction may be implemented by using a trained target feature extraction model, where the target feature extraction model is trained using the following method:

[0184] Based on multiple preset main domain names and historical subdomain name sets, the feature extraction model to be trained is trained for multiple rounds of iterations, and the trained target feature extraction model is output. Each round of iteration training can adjust the model parameters of the feature extraction model based on at least one preset main domain name and its corresponding historical subdomain name set. The following takes one round of iteration training based on a preset main domain name and its corresponding historical subdomain name set as an example for introduction.

[0185] Character features are extracted from the subdomain prefixes of each historical subdomain included in the historical subdomain set of the preset main domain, respectively, to obtain character features of the subdomain prefixes of each historical subdomain. Each obtained character feature is mapped to a main domain training feature of the preset main domain. Based on the difference between the obtained main domain training feature and the main domain sample feature extracted from the preset main domain, the model parameters of the feature extraction model are adjusted.

[0186] By adjusting the model parameters of the feature extraction model, the feature extraction model can learn the character co-occurrence between the characters in the subdomain prefix and the connectivity between the subdomain prefix and the preset main domain name, so that the prefix features can be extracted more accurately.

[0187] As an embodiment, the feature extraction model includes a character feature extraction network, and the character feature extraction network is used to perform character feature extraction. The character feature extraction network may be trained before training other networks in the feature extraction model, or may be trained together with other networks in the feature extraction model. There is no specific limitation. In the embodiment of the present application, the character feature extraction network is taken as an example that has been trained before training other networks in the feature extraction model.

[0188] The following is an introduction to the training process of the character feature extraction network. For each historical subdomain set, the following operations are performed:

[0189] Character feature extraction is performed on the subdomain prefix of each historical subdomain included in the historical subdomain set to obtain a corresponding character feature sequence. The character feature sequence includes multiple feature elements, each of which is used to describe the feature of a character in the subdomain prefix.

[0190] Perform character masking on each obtained character feature sequence to obtain a corresponding masked feature sequence, and perform character prediction on each obtained masked feature sequence to obtain a corresponding predicted character sequence. Adjust network parameters of the character feature extraction network based on the difference between each obtained predicted character sequence and the subdomain prefix of the corresponding historical subdomain.

[0191] By using character masking, the character feature extraction network can learn the co-occurrence of characters in the subdomain prefix, thereby extracting character features more accurately.

[0192] Please refer to Figure 4 , taking the subdomain prefix of a historical subdomain as "email" as an example, character features are extracted from the subdomain prefix to obtain a character feature sequence, which is used to describe the characteristics of the characters "e", "m", "a", "i" and "l". The character "a" is masked to obtain a masked feature sequence. The feature elements corresponding to the characters "e", "m", "i" and "l" in the masked feature sequence are weighted summed, and the result of the weighted summation is predicted to obtain the corresponding masked characters. The masked characters and the characters "e", "m", "i" and "l" can form a predicted character sequence. Based on the difference between the masked characters and the character "a", the network parameters of the character feature extraction network can be adjusted.

[0193] As an embodiment, when performing character masking, each obtained character feature sequence can be slidingly segmented with a preset feature length or a preset character length to obtain a feature subsequence set corresponding to each character feature sequence. Each feature subsequence is used to describe the characteristics of a prefix segment in the subdomain prefix of the corresponding historical subdomain. Each prefix segment contains multiple characters in the corresponding subdomain prefix. Then, for each obtained feature subsequence set, respectively perform: respectively mask the feature elements corresponding to at least one character in each feature subsequence contained in the feature subsequence set, and use each obtained masked subsequence as a masked feature sequence.

[0194] When performing character prediction, for each obtained mask feature sequence, the following steps may be performed respectively: character prediction may be performed on each mask cap sequence in the mask feature sequence respectively, and each obtained predicted character segment may be used as a predicted character sequence.

[0195] As an embodiment, when mapping each obtained character feature to a primary domain name training feature of a preset primary domain name, a feature matrix established based on each obtained character feature can be firstly subjected to a nonlinear transformation to obtain an associated weight vector. Each vector element in the associated weight vector represents: each historical subdomain name included in the historical subdomain name set of the preset primary domain name, and the degree of association between each historical subdomain name and the preset primary domain name. Using each vector element included in the associated weight vector as a weight, each character feature is fused to obtain the primary domain name training feature of the preset primary domain name.

[0196] Please refer to formula (1) as a nonlinear transformation method and formula (2) as a fusion method.

[0197]

[0198] in, represents the association weight vector, represents a part of the network parameters, represents the feature matrix, Represents the main domain training features. The i-th row in the feature matrix is ​​the i-th character feature. is an activation function, and the joint weight vector can represent the influence of each subdomain prefix on the main domain name to be blasted.

[0199] As an embodiment, when adjusting the model parameters of the feature extraction model based on the difference between the obtained primary domain name training features and the primary domain name sample features extracted from the preset primary domain name, the model parameters of the feature extraction model may be adjusted when the difference does not meet the training objectives, until the difference obtained in a certain round of iterative training meets the training objectives, and then the target feature extraction model is output.

[0200] In addition to this difference, the model parameters of the feature extraction model may also be adjusted in combination with other factors, one of which is introduced below.

[0201] The obtained main domain training features and the character features of a historical subdomain in the historical subdomain set of the preset main domain are concatenated to obtain concatenated features. Domain name prediction is performed on the obtained concatenated features to obtain domain name prediction results. Based on the difference between the obtained main domain training features and the main domain sample features extracted from the sample main domain, and the difference between the obtained domain prediction result and the subdomain prefix of a historical subdomain, the model parameters of the feature extraction model are adjusted.

[0202] When at least one of the two differences obtained does not meet the corresponding training objectives, the model parameters of the feature extraction model are adjusted until both differences obtained in a certain round of iterative training meet the training objectives, and then the target feature extraction model is output.

[0203] For example, the main domain training feature is recorded as , the character features of a historical subdomain are recorded as , then the splicing feature can be After the concatenated features pass through the fully connected layer and the activation function layer, the probability distribution is obtained, which is recorded as The probability distribution can represent the probability that the predicted domain name prediction result is the subdomain prefix of the historical subdomain, and the probability can be a value between 0 and 1.

[0204] Then, please refer to formula (3), which is the difference between the obtained domain name prediction result and the subdomain prefix of a historical subdomain A way of calculating .

[0205]

[0206] As an embodiment, the feature extraction model also includes a feature comparison network, and the feature comparison network is used to adjust the model parameters of the feature extraction model. Then, when adjusting the model parameters of the feature extraction model based on the difference between the obtained primary domain name training features and the primary domain name sample features extracted from the preset primary domain name, another factor can also be considered.

[0207] Based on the number of primary domain names of each preset primary domain name, similar characters are clustered for each character feature to obtain multiple clusters, where the number of clusters is the number of primary domain names. Based on the distance between the primary domain name training feature and the cluster centers of each of the multiple clusters, and the difference between the obtained primary domain name training feature and the primary domain name sample feature extracted from the preset primary domain name, the model parameters of the feature extraction model are adjusted.

[0208] As an embodiment, when adjusting the model parameters of the feature extraction model based on the distance between the primary domain training feature and the respective cluster centers of the multiple clusters, and the difference between the obtained primary domain training feature and the primary domain sample feature extracted from the preset primary domain, the model parameters of the feature extraction model may be adjusted based on at least two of the following training objectives:

[0209] The minimum distance between the main domain name training feature and the cluster centers of the plurality of clusters is less than a first distance threshold. The distances between the main domain name training feature and the cluster centers other than the cluster center corresponding to the minimum distance are greater than a second distance threshold. The difference between the main domain name training feature obtained and the main domain name sample feature extracted from the preset main domain name is less than a preset difference threshold.

[0210] Therefore, by adjusting the model parameters, the main domain training feature is made as close as possible to the cluster center closest to the main domain training feature, and the main domain training feature is as far away from other cluster centers as possible.

[0211] Please refer to formula (4), which is a training loss for the distance between the main domain training feature and the cluster centers of multiple clusters. .

[0212]

[0213] As an embodiment, for multiple candidate subdomain sets, respectively, the following operations are performed: prefix features extracted from the subdomain prefixes of each candidate subdomain in the candidate subdomain set are merged to obtain set features of the candidate subdomain set. For multiple reference subdomains, the following operations are performed: based on the prefix features extracted from the reference subdomain and the obtained set features, the matching degree between the reference subdomain and multiple candidate subdomain sets is determined respectively. From the multiple candidate subdomain sets, a target subdomain set with a matching degree greater than a matching degree threshold is selected.

[0214] Please refer to formula (5) for a method of determining the degree of matching.

[0215]

[0216] in, , , represents the distance between features, Represents the candidate subdomain set, Indicates the reference subdomain, Indicates the main domain name to be blasted.

[0217] Please refer to Figure 5 The historical subdomains included in the historical subdomain set of the preset main domain include, for example, the following four: email.example.com, sports.example.com, news.example.com, and business.example.com. Extract the subdomain prefixes of each historical subdomain, which are email, sports, news, and business. Perform character feature extraction on each obtained subdomain prefix to obtain corresponding character features.

[0218] On the one hand, based on the obtained character features, similar characters are clustered for each subdomain prefix, for example, similar characters are clustered using the kmeans clustering method to obtain multiple clusters. The distance between the main domain training feature and the cluster centers of each of the multiple clusters is determined, and the cluster center corresponding to the lowest distance is used as the reference center. According to the above formula (4), the distance training loss is determined based on the distance between the main domain training feature and the reference center, and the distance between the main domain training feature and other cluster centers.

[0219] On the other hand, the main domain name training features and each character feature are sequentially concatenated to obtain corresponding concatenated features, and domain name prediction is performed on each obtained concatenated feature to obtain corresponding domain name prediction results.

[0220] Based on the difference between each domain name prediction result and the corresponding subdomain prefix, the concatenation training loss is determined.

[0221] Adjust model parameters based on distance training loss and splicing training loss.

[0222] S203: Selecting a plurality of target subdomains having similarities greater than a third similarity threshold for corresponding reference subdomains from each of the obtained target subdomain sets.

[0223] After obtaining the target subdomain sets corresponding to the multiple reference subdomains, multiple target subdomains with similarities greater than a third similarity threshold can be selected for the corresponding reference subdomains from each of the obtained target subdomain sets. The third similarity threshold can be determined based on a preset number of selections, or can be determined based on an empirical value, etc., and is not specifically limited.

[0224] Taking the selection of P target subdomains as an example, when a main domain name A to be blasted is input, the recommended calculation amount of P subdomains is:

[0225] Find similar subdomains, that is, V target subdomain sets, each target subdomain set contains M candidate subdomains, and R target subdomains are selected from each M candidate subdomain. Similarity calculation is performed, where K is the number of candidate subdomains.

[0226] from subdomains to find P subdomains that need to be recommended, that is, each target subdomain needs Similarity calculations. Then, the total amount of calculations is: .

[0227] V, R, and K can generally be set to no more than 100. Therefore, the total complexity can be regarded as O(M), and the larger K is, the smaller M will be. Compared with other subdomain blasting methods, such as blasting subdomains constructed from a million-level dictionary, the subdomain blasting method provided in the embodiment of the present application can greatly reduce the blasting of invalid subdomains and improve resource utilization.

[0228] S204: Based on the obtained target subdomains, subdomain blasting is performed on the main domain to be blasted to obtain a subdomain blasting result.

[0229] After obtaining each target subdomain, the main domain to be blasted can be subdomain blasted based on each target subdomain to obtain the subdomain blasting result. The subdomain blasting result can reflect the subdomain actually used by the main domain to be blasted.

[0230] As an embodiment, when performing subdomain blasting, multiple recommended subdomains whose correlation with the main domain to be blasted meets the association condition can be selected from the obtained target subdomains. Based on the obtained multiple recommended subdomains, subdomain blasting is performed on the main domain to be blasted to obtain the subdomain blasting result.

[0231] As an embodiment, when there are multiple recommended subdomains whose relevance satisfies the association condition, for each obtained target subdomain, the following operations can be performed: the similarities between multiple reference subdomains and the main domain to be blasted are integrated, and the similarities between multiple reference subdomains and the target subdomain are integrated to determine the relevance between the target subdomain and the main domain to be blasted. Thus, based on the obtained relevances, multiple recommended subdomains with relevance greater than a preset relevance threshold can be selected from each target subdomain.

[0232] The following uses two scenarios as examples to introduce the subdomain blasting method provided in the embodiments of the present application.

[0233] In the field of attack surface management, subdomain blasting can help security experts fully understand an organization's Internet assets by generating and testing a large number of potential subdomains. Many organizations may host various services under different subdomains, including web pages, APIs, mail servers, etc. These subdomains often become potential security vulnerabilities because they are low-key or forgotten. Through subdomain blasting, unrecorded or neglected subdomains can be identified, thereby drawing a complete picture of the attack surface. The security team can then evaluate these subdomains to ensure that each subdomain is properly protected to avoid security incidents caused by omissions. This not only improves the overall security protection level, but also prevents attackers from discovering sensitive information or vulnerabilities within the organization through subdomains, and then launching further attacks.

[0234] Please refer to Figure 6 When training the feature extraction model, you can first collect company names, ICP data, and DNS data, so that you can create multiple sample data. The sample data can include a preset main domain name and its associated historical subdomain name set. Based on multiple sample data, the feature extraction model is trained for multiple rounds of iterations to output a trained target feature extraction model.

[0235] The target feature extraction model is adopted to execute the following steps for each historical subdomain name set obtained: extracting prefix features of each historical subdomain name contained in the historical subdomain name set to obtain corresponding prefix features; clustering similar subdomain names of each historical subdomain name set based on the obtained prefix features to obtain the multiple candidate subdomain name sets.

[0236] Before performing multiple rounds of iterative training on the feature extraction model, the character feature extraction network in the feature extraction model is firstly subjected to multiple rounds of iterative training. Each round of iterative training includes:

[0237] For each of the historical subdomain name sets, the following operations are performed respectively: character feature extraction is performed on the subdomain name prefix of each of the historical subdomain names included in the historical subdomain name set to obtain a corresponding character feature sequence. Character masking is performed on each of the obtained character feature sequences to obtain a corresponding masked feature sequence, and character prediction is performed on each of the obtained masked feature sequences to obtain a corresponding predicted character sequence. Based on the difference between each of the obtained predicted character sequences and the subdomain name prefix of the corresponding historical subdomain name, the network parameters of the character feature extraction network are adjusted so that the character feature extraction network learns the character feature extraction capability, thereby accurately extracting the character feature sequence of the subdomain name prefix.

[0238] Therefore, when performing multiple rounds of iterative training on the feature extraction model, the character feature sequence of each historical subdomain name can be extracted through the trained character feature extraction network, and the mean of each feature element contained in the character feature sequence can be used as the character feature of the corresponding historical subdomain name.

[0239] Each iteration of training the feature extraction model includes:

[0240] After obtaining the character features of each historical subdomain name, the character features of each historical subdomain name included in the historical subdomain name set corresponding to each preset main domain name can be mapped to the main domain name training features of the preset main domain name.

[0241] The model is built based on the connectivity between the primary domain name and the prefix. The so-called connectivity refers to whether the prefix is ​​a subdomain of the primary domain name in historical data.

[0242] For each preset main domain name, a subdomain prefix of a historical subdomain name is randomly extracted from the corresponding historical subdomain name set, and its character features are obtained. The character features are concatenated with the main domain name training features of the corresponding preset main domain name to obtain the concatenated features. The concatenated features are passed through the fully connected layer and the activation function layer to obtain the domain name prediction result, and the concatenated training loss is calculated according to the above formula (3).

[0243] For each set of historical subdomain names corresponding to the preset main domain name, similar characters are clustered for each character feature to obtain multiple clusters. The distances between the main domain name training features of the corresponding preset main domain name and the cluster centers corresponding to each of the multiple clusters are determined respectively. The distance training loss is calculated according to the above formula (4).

[0244] Based on the weighted sum of the concatenation training loss and the distance training loss, the model parameters of the feature extraction model are adjusted so that the feature extraction model has a more accurate prefix feature extraction capability.

[0245] When using the target feature extraction model, when a main domain name A is input, refer to the previous introduction to obtain the historical subdomain name set corresponding to the main domain name A, extract V historical subdomain names from the historical subdomain name set, and for any historical subdomain name v, calculate the similarity between the historical subdomain name v and the cluster centers of multiple candidate subdomain name sets, and select the most similar candidate subdomain name set as the target subdomain name set for the historical subdomain name v. Using the similarity between the historical subdomain name v and each candidate subdomain name in the target subdomain name set, select the target subdomain name that is most similar to the historical subdomain name v from the target subdomain name set. According to formula (5), the matching degree between the obtained target subdomain name and the main domain name A is calculated, and the P recommended subdomain names with the highest matching degree are selected for subdomain name blasting to obtain the real subdomain names, which greatly reduces the blasting of invalid subdomain names and improves the utilization of resources.

[0246] Please refer to Figure 7 , a historical subdomain of the main domain name A, denoted as subdomain a, is similar to a historical subdomain of the main domain name B, denoted as subdomain c, and when subdomain a is similar to the main domain name B, it can be considered that the main domain name B matches subdomain a, so that the subdomain blasting of the main domain name B can be performed based on subdomain a.

[0247] Provide real subdomains to security experts, who analyze undocumented or overlooked subdomains to create a complete attack surface picture; and evaluate subdomains to ensure that each subdomain is properly protected to avoid security incidents caused by omissions.

[0248] In the field of penetration testing and vulnerability mining, subdomain blasting methods are also indispensable tools. Through subdomain blasting, penetration testers can discover hidden subdomains in the target system. These subdomains may run different applications or services, thus providing attackers with more potential attack entrances. For example, a forgotten development environment or test environment may not have strict security protection, becoming an easy entrance for attackers to break through. After discovering these subdomains, penetration testers can conduct further security tests on them to find possible vulnerabilities, such as unupdated services, default passwords, and publicly disclosed sensitive information. Through these means, security vulnerabilities can be discovered and fixed in advance, preventing attackers from using these subdomains for illegal intrusion and data theft, and ultimately improving the security of the entire system. The specific subdomain blasting method can be referred to the previous introduction, and will not be repeated here.

[0249] Through subdomain blasting, penetration testers can find hidden subdomains in the target system. After discovering these subdomains, penetration testers can conduct further security tests on them to find possible vulnerabilities, such as unupdated services, default passwords, and public sensitive information. After that, penetration testers will shut down the asset, fix the vulnerability, and improve the security of the system.

[0250] Based on the same inventive concept, the present application embodiment provides a subdomain blasting device that can implement the functions corresponding to the aforementioned subdomain blasting method. Figure 8 , the device includes an acquisition module 801 and a processing module 802, wherein:

[0251] Acquisition module 801: used to acquire multiple reference subdomains of the main domain to be blasted; wherein the reference subdomains are: subdomains that include the main domain to be blasted and are enabled in the historical time;

[0252] Processing module 802: used to select matching target subdomain sets for multiple reference subdomains from multiple pre-stored candidate subdomain sets; wherein the candidate subdomains in each candidate subdomain set are subdomains activated in the historical time; the similarity between the candidate subdomains in different candidate subdomain sets is less than a first similarity threshold; the similarity between the candidate subdomains in the same candidate subdomain set is greater than a second similarity threshold;

[0253] The processing module 802 is further configured to: respectively select a plurality of target subdomains having a similarity greater than a third similarity threshold for the corresponding reference subdomains from each of the obtained target subdomain sets;

[0254] The processing module 802 is further used to: perform subdomain blasting on the main domain name to be blasted based on each obtained target subdomain name, and obtain the subdomain blasting result.

[0255] Optionally, the acquisition module 801 is specifically used for:

[0256] Get the object to be blasted;

[0257] Determine the to-be-blasted main domain name of the to-be-blasted object based on the first mapping relationship between each reference object and each preset main domain name;

[0258] Based on the second mapping relationship between each preset main domain name and each historical subdomain name set, determine the historical subdomain name set of the main domain name to be blasted; wherein the second mapping relationship indicates that: the historical subdomain name in the historical subdomain name set contains the corresponding preset main domain name and is enabled within the historical time;

[0259] Select multiple reference subdomains from the obtained historical subdomain set.

[0260] Optionally, the processing module 802 is further configured to:

[0261] Get the historical subdomain sets of multiple preset main domains;

[0262] For each obtained historical subdomain name set, respectively perform: extract prefix features of each historical subdomain name included in the historical subdomain name set to obtain corresponding prefix features;

[0263] Based on the obtained prefix features, similar subdomains are clustered for each historical subdomain set to obtain multiple candidate subdomain sets; wherein each candidate subdomain contained in each candidate subdomain set comes from at least one historical subdomain set.

[0264] Optionally, the prefix feature extraction is implemented by using a trained target feature extraction model, and the target feature extraction model is trained by the following method. The processing module 802 is specifically used for:

[0265] Based on multiple preset main domain names and historical subdomain name sets, the feature extraction model to be trained is trained for multiple rounds of iterations, and the trained target feature extraction model is output; wherein each round of iteration includes:

[0266] Extracting character features from the subdomain prefixes of each historical subdomain included in the historical subdomain set of the preset main domain name to obtain character features of the subdomain prefixes of each historical subdomain;

[0267] Mapping each character feature obtained into a primary domain name training feature of a preset primary domain name;

[0268] Based on the difference between the obtained main domain name training features and the main domain name sample features extracted from the preset main domain name, the model parameters of the feature extraction model are adjusted.

[0269] Optionally, the feature extraction model includes a character feature extraction network, which is used to extract character features. The character feature extraction network is trained using the following method. The processing module 802 is specifically used for:

[0270] For each historical subdomain set, perform the following operations:

[0271] Extracting character features from the subdomain prefixes of each historical subdomain included in the historical subdomain set to obtain a corresponding character feature sequence;

[0272] Performing character masking on each obtained character feature sequence to obtain a corresponding masked feature sequence, and performing character prediction on each obtained masked feature sequence to obtain a corresponding predicted character sequence;

[0273] Based on the differences between each of the obtained predicted character sequences and the subdomain prefix of the corresponding historical subdomain, the network parameters of the character feature extraction network are adjusted.

[0274] Optionally, the processing module 802 is specifically configured to:

[0275] The obtained character feature sequences are respectively subjected to sliding segmentation with a preset feature length to obtain feature subsequence sets corresponding to each character feature sequence; wherein each feature subsequence is used to describe the features of a prefix segment in the subdomain prefix of the corresponding historical subdomain; and each prefix segment contains multiple characters in the corresponding subdomain prefix;

[0276] For each obtained feature subsequence set, respectively performing: respectively covering a feature element corresponding to at least one character in each feature subsequence contained in the feature subsequence set, and taking each obtained covered subsequence as a covered feature sequence;

[0277] For each obtained mask feature sequence, respectively perform the following steps: respectively perform character prediction on each mask cap sequence in the mask feature sequence, and use each obtained predicted character segment as a predicted character sequence.

[0278] Optionally, the processing module 802 is specifically configured to:

[0279] A feature matrix established based on the obtained character features is nonlinearly transformed to obtain an associated weight vector; wherein each vector element in the associated weight vector represents: the degree of association between each historical subdomain name included in the historical subdomain name set of the preset main domain name and the preset main domain name;

[0280] Each vector element contained in the associated weight vector is used as a weight, and each character feature is integrated to obtain the main domain name training feature of the preset main domain name.

[0281] Optionally, the processing module 802 is specifically configured to:

[0282] The obtained main domain name training feature is concatenated with the character feature of a historical subdomain name in the historical subdomain name set of the preset main domain name to obtain a concatenated feature;

[0283] Perform domain name prediction on the obtained splicing features to obtain domain name prediction results;

[0284] Based on the difference between the obtained main domain training features and the main domain sample features extracted from the sample main domain, and the difference between the obtained domain prediction result and the subdomain prefix of a historical subdomain, the model parameters of the feature extraction model are adjusted.

[0285] Optionally, the feature extraction model further includes a feature contrast network, and the feature contrast network is used to adjust model parameters of the feature extraction model;

[0286] The processing module 802 is specifically used for:

[0287] Based on the number of primary domain names of each preset primary domain name, similar characters are clustered for each character feature to obtain multiple clusters;

[0288] Based on the distance between the main domain training feature and the respective cluster centers of the multiple clusters, and the difference between the obtained main domain training feature and the main domain sample feature extracted from the preset main domain, the model parameters of the feature extraction model are adjusted.

[0289] Optionally, the processing module 802 is specifically configured to:

[0290] Adjust model parameters of the feature extraction model based on at least two of the following training objectives:

[0291] The minimum distance between the main domain training feature and the cluster centers of the plurality of clusters is less than a first distance threshold;

[0292] The distances between the cluster centers other than the cluster center corresponding to the minimum distance are greater than a second distance threshold;

[0293] The difference between the obtained main domain name training feature and the main domain name sample feature extracted from the preset main domain name is less than a preset difference threshold.

[0294] Optionally, the processing module 802 is specifically configured to:

[0295] For multiple candidate subdomain sets, respectively perform: fusing prefix features extracted from the subdomain prefixes of each candidate subdomain in the candidate subdomain set to obtain set features of the candidate subdomain set;

[0296] For multiple reference subdomains, perform the following operations respectively:

[0297] Based on the prefix features extracted from the reference subdomain and the features of each set obtained, the matching degree between the reference subdomain and the multiple candidate subdomain sets is determined respectively;

[0298] From multiple candidate subdomain sets, select a target subdomain set whose matching degree is greater than a matching degree threshold.

[0299] Optionally, the processing module 802 is specifically configured to:

[0300] From each target subdomain obtained, select multiple recommended subdomains whose relevance to the main domain to be blasted meets the association condition;

[0301] Based on the obtained multiple recommended subdomains, subdomain blasting is performed on the main domain name to be blasted to obtain the subdomain blasting result.

[0302] Optionally, the processing module 802 is specifically configured to:

[0303] For each target subdomain obtained, respectively perform: integrating the similarities between multiple reference subdomains and the main domain to be blasted, and the similarities between the target subdomain and multiple reference subdomains, to determine the correlation between the target subdomain and the main domain to be blasted;

[0304] Based on the obtained relevances, multiple recommended subdomains with relevances greater than a preset relevance threshold are selected from the target subdomains.

[0305] Please refer to Fig. 9 , is a computer device 900 provided in an embodiment of the present application, and the computer device 900 can be, for example, Figure 1 The client 102 or the server 101 in the data storage program. The current version and the historical version of the data storage program and the application software corresponding to the data storage program can be installed on the computer device 900, and the computer device 900 includes a processor 980 and a memory 920. In some embodiments, the computer device 900 may include a display unit 940, and the display unit 940 includes a display panel 941 for displaying a user interactive operation interface, etc.

[0306] In a possible embodiment, the display panel 941 may be configured in the form of a liquid crystal display (LCD) or an organic light-emitting diode (OLED).

[0307] The processor 980 is used to read the computer program and then execute the method defined by the computer program. For example, the processor 980 reads the data storage program or file, so as to run the data storage program on the computer device 900 and display the corresponding interface on the display unit 940. The processor 980 may include one or more general-purpose processors and may also include one or more DSPs (Digital Signal Processors) to perform related operations to implement the technical solutions provided in the embodiments of the present application.

[0308] The memory 920 generally includes internal memory and external memory. The internal memory may be a random access memory (RAM), a read-only memory (ROM), and a cache (CACHE), etc. The external memory may be a hard disk, an optical disk, a USB disk, a floppy disk, or a tape drive, etc. The memory 920 is used to store computer programs and other data. The computer program includes applications corresponding to each client, etc. Other data may include data generated after the operating system or application is run, and the data includes system data (such as configuration parameters of the operating system) and user data. In the embodiment of the present application, the computer program is stored in the memory 920, and the processor 980 executes the computer program in the memory 920 to implement any of the methods discussed in the previous figure.

[0309] The display unit 940 is used to receive input digital information, character information or contact touch operation / contactless gesture, and generate signal input related to user settings and function control of the computer device 900. Specifically, in the embodiment of the present application, the display unit 940 may include a display panel 941. The display panel 941 is, for example, a touch screen, which can collect user touch operations on or near it (such as operations performed by the user using fingers, stylus, or any other suitable object or accessory on or on the display panel 941), and drive corresponding connection devices according to a pre-set program.

[0310] In a possible embodiment, the display panel 941 may include two parts: a touch detection device and a touch controller. The touch detection device detects the touch position of the player, detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts it into the touch point coordinates, and then sends it to the processor 980, and can receive and execute the command sent by the processor 980.

[0311] The display panel 941 may be implemented in various types such as resistive, capacitive, infrared, and surface acoustic wave. In addition to the display unit 940, in some embodiments, the computer device 900 may further include an input unit 930, which may include an image input device 931 and other input devices 932, wherein the other input devices may include, but are not limited to, one or more of a physical keyboard, a function key (such as a volume control key, a switch key, etc.), a trackball, a mouse, a joystick, and the like.

[0312] In addition to the above, the computer device 900 may also include a power supply 990 for supplying power to other modules, an audio circuit 960, a near field communication module 970, and an RF circuit 910. The computer device 900 may also include one or more sensors 950, such as an acceleration sensor, a light sensor, a pressure sensor, etc. The audio circuit 960 specifically includes a speaker 961 and a microphone 962, etc. For example, the computer device 900 can collect the user's voice through the microphone 962 to perform corresponding operations, etc.

[0313] As an embodiment, the number of processors 980 may be one or more, and the processor 980 and the memory 920 may be coupled or relatively independently configured.

[0314] As an example, Fig. 9 The processor 980 in the embodiment can be used to implement the following Figure 8 The functions of the acquisition module 801 and the processing module 802 in .

[0315] As an example, Fig. 9 The processor 980 in can be used to implement the corresponding functions of the server or terminal device discussed above.

[0316] A person of ordinary skill in the art can understand that: all or part of the steps of implementing the above method embodiments can be completed by a computer program, and the aforementioned computer program can be stored in a computer-readable storage medium. When the computer program is executed, it executes the steps of the above method embodiments; and the aforementioned storage medium includes: a mobile storage device, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0317] Alternatively, if the above-mentioned integrated unit of the present invention is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present invention can be essentially or partly reflected in the form of a software product, for example, through a computer program product, which is stored in a storage medium, including a computer program for a computer device to execute all or part of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, RAM, magnetic disks or optical disks.

[0318] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A subdomain blasting method, characterized in that: include: Acquire multiple reference subdomains of the main domain to be blasted; wherein the reference subdomains are: subdomains that are activated in the historical time and include the main domain to be blasted; For multiple pre-stored candidate subdomain sets, respectively performing: fusing prefix features extracted from the subdomain prefixes of each candidate subdomain in the candidate subdomain set to obtain set features of the candidate subdomain set; wherein each candidate subdomain in the candidate subdomain set is a subdomain enabled within the historical time; the similarity between candidate subdomains in different candidate subdomain sets is less than a first similarity threshold; the similarity between candidate subdomains in the same candidate subdomain set is greater than a second similarity threshold; For the multiple reference subdomains, the following operations are respectively performed: based on the prefix features extracted from the reference subdomains and the obtained set features, the matching degrees between the reference subdomains and the multiple candidate subdomain sets are respectively determined, and from the multiple candidate subdomain sets, a target subdomain set whose matching degree is greater than a matching degree threshold is selected; Selecting, from each of the obtained target subdomain sets, a plurality of target subdomains having similarities greater than a third similarity threshold for the corresponding reference subdomains; Based on each obtained target subdomain, subdomain blasting is performed on the main domain to be blasted to obtain a subdomain blasting result.

2. The method according to claim 1, characterized in that The multiple candidate subdomain sets are obtained by the following method: Get the historical subdomain sets of multiple preset main domains; For each obtained historical subdomain name set, respectively perform: extract prefix features of each historical subdomain name included in the historical subdomain name set to obtain corresponding prefix features; Based on the obtained prefix features, similar subdomains are clustered for the historical subdomain sets to obtain the multiple candidate subdomain sets; wherein each candidate subdomain contained in each candidate subdomain set comes from at least one historical subdomain set.

3. The method according to claim 2, characterized in that The prefix feature extraction is implemented by using a trained target feature extraction model, and the target feature extraction model is trained by the following method: Based on the multiple preset main domain names and the historical subdomain name sets, the feature extraction model to be trained is trained for multiple rounds of iterations to output a trained target feature extraction model; wherein each round of iterations includes: Extracting character features from the subdomain name prefixes of each historical subdomain name included in the historical subdomain name set of the preset main domain name, respectively, to obtain character features of the subdomain name prefixes of each historical subdomain name; Mapping each character feature obtained into a primary domain name training feature of the preset primary domain name; Based on the difference between the obtained primary domain name training features and the primary domain name sample features extracted from the preset primary domain name, the model parameters of the feature extraction model are adjusted.

4. The method according to claim 3, characterized in that The feature extraction model includes a character feature extraction network, which is used to extract character features. The character feature extraction network is trained using the following method: For each of the historical subdomain sets, perform the following operations respectively: Extracting character features from the subdomain prefixes of each historical subdomain included in the historical subdomain set to obtain a corresponding character feature sequence; Performing character masking on each obtained character feature sequence to obtain a corresponding masked feature sequence, and performing character prediction on each obtained masked feature sequence to obtain a corresponding predicted character sequence; Based on the differences between each of the obtained predicted character sequences and the subdomain prefix of the corresponding historical subdomain, the network parameters of the character feature extraction network are adjusted.

5. The method according to claim 3, characterized in that: The step of mapping the obtained character features into the primary domain name training features of the preset primary domain name includes: A feature matrix established based on each character feature obtained is subjected to nonlinear transformation to obtain an associated weight vector; wherein each vector element in the associated weight vector represents: the degree of association between each historical subdomain name included in the historical subdomain name set of the preset main domain name and the preset main domain name; The vector elements included in the association weight vector are used as weights, and the character features are integrated to obtain the primary domain name training features of the preset primary domain name.

6. The method according to claim 3, characterized in that The adjusting the model parameters of the feature extraction model based on the difference between the obtained primary domain name training features and the primary domain name sample features extracted from the preset primary domain name includes: The obtained main domain name training feature is concatenated with the character feature of a historical subdomain name in the historical subdomain name set of the preset main domain name to obtain a concatenated feature; Perform domain name prediction on the obtained splicing features to obtain domain name prediction results; Based on the difference between the obtained main domain name training features and the main domain name sample features extracted from the sample main domain name, and the difference between the obtained domain name prediction result and the subdomain name prefix of the one historical subdomain name, the model parameters of the feature extraction model are adjusted.

7. The method according to claim 3, characterized in that The feature extraction model further includes a feature contrast network, and the feature contrast network is used to adjust the model parameters of the feature extraction model; Then, adjusting the model parameters of the feature extraction model based on the difference between the obtained primary domain name training features and the primary domain name sample features extracted from the preset primary domain name includes: Based on the number of primary domain names of the preset primary domain names, similar characters are clustered for the character features to obtain a plurality of clusters; Based on the distance between the primary domain name training feature and the respective cluster centers of the multiple clusters, and the difference between the obtained primary domain name training feature and the primary domain name sample feature extracted from the preset primary domain name, the model parameters of the feature extraction model are adjusted.

8. The method according to claim 7, characterized in that The adjusting the model parameters of the feature extraction model based on the distance between the primary domain training feature and the respective cluster centers of the plurality of clusters, and the difference between the obtained primary domain training feature and the primary domain sample feature extracted from the preset primary domain, includes: Adjusting model parameters of the feature extraction model based on at least two of the following training objectives: The minimum distance between the main domain name training feature and the cluster centers of the plurality of clusters is less than a first distance threshold; The distances between the cluster centers other than the cluster center corresponding to the minimum distance are greater than a second distance threshold; The difference between the obtained main domain name training feature and the main domain name sample feature extracted from the preset main domain name is less than a preset difference threshold.

9. The method according to any one of claims 1 to 8, characterized in that Based on each obtained target subdomain, subdomain blasting is performed on the main domain to be blasted to obtain the subdomain blasting result, including: From the obtained target subdomains, select multiple recommended subdomains whose relevance to the main domain to be blasted meets the association condition; Based on the obtained multiple recommended subdomains, subdomain blasting is performed on the main domain to be blasted to obtain a subdomain blasting result.

10. The method according to claim 9, characterized in that The step of selecting, from the obtained target subdomains, a plurality of recommended subdomains whose relevance to the main domain to be blasted satisfies the association condition includes: For each obtained target subdomain, respectively: integrating the similarities between the multiple reference subdomains and the main domain to be blasted, and the similarities between the multiple reference subdomains and the target subdomain, to determine the correlation between the target subdomain and the main domain to be blasted; Based on the obtained relevances, a plurality of recommended subdomains having relevances greater than a preset relevance threshold are selected from the target subdomains.

11. A subdomain blasting device, characterized in that: include: Acquisition module: used to acquire multiple reference subdomains of the main domain to be blasted; wherein the reference subdomains are: subdomains that are activated in the historical time and include the main domain to be blasted; The processing module is used to respectively perform the following steps for the pre-stored multiple candidate subdomain sets: fusing prefix features extracted from the subdomain prefixes of each candidate subdomain in the candidate subdomain set to obtain set features of the candidate subdomain set; wherein each candidate subdomain in the candidate subdomain set is a subdomain enabled within the historical time; the similarity between candidate subdomains in different candidate subdomain sets is less than a first similarity threshold; the similarity between candidate subdomains in the same candidate subdomain set is greater than a second similarity threshold; The processing module is further configured to: for the multiple reference subdomains, respectively perform the following operations: based on the prefix features extracted from the reference subdomains and the obtained set features, respectively determine the matching degree between the reference subdomains and the multiple candidate subdomain sets, and select a target subdomain set with a matching degree greater than a matching degree threshold from the multiple candidate subdomain sets; The processing module is further used to: respectively select a plurality of target subdomains having a similarity greater than a third similarity threshold for the corresponding reference subdomains from each of the obtained target subdomain sets; The processing module is further used to: perform subdomain blasting on the main domain name to be blasted based on each obtained target subdomain name, and obtain a subdomain blasting result.

12. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 10 is implemented.

13. A computer device, characterized in that: include: A memory for storing program instructions; A processor, configured to call the program instructions stored in the memory, and execute the method according to any one of claims 1 to 10 according to the obtained program instructions.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable a computer to execute the method according to any one of claims 1 to 10.

Images