System and method for router generation device to access domain name item set, electronic device and storage medium

Abstract

The invention discloses a system and method for a router generation device to access a domain name item set, an electronic device and a storage medium, and relates to the technical field of routers, and the system comprises a message analysis module which is used for monitoring a network message, filtering a DNS request message, analyzing the message, recombining the message, and sending a domain name record message to a message monitoring and data processing module; and the message monitoring and data processing module is used for detecting the state of the terminal equipment under the router, processing data after monitoring the domain name record message sent by the message analysis module, and storing the DNS request data record of the matched terminal equipment under the router and the domain name data of all DNS request analysis during the online period of the terminal equipment. According to the method and the device, the record item set of the domain name initiating the DNS resolution request in the time period from connection to disconnection of the router of each terminal device can be generated. A record field generated by the method comprises terminal equipment MAC, router MAC connected with the terminal, record generation time, terminal equipment online time and offline time, a domain name requested to be analyzed by the terminal, time of an epoch of initiating the request and the like, online and offline conditions of the equipment are concerned, data granularity is refined, and the efficiency is improved. And richer information can be provided for subsequent data analysis work.

Description

Technical Field

[0001] The present invention relates to the technical field of router equipment, and in particular to a system, method, electronic equipment and storage medium for generating a domain name item set for a router to access the domain name item set. Background Art

[0002] User behavior analysis has always been an important application direction of data mining technology. Major network platforms, e-commerce, etc. all record user behavior through business tracking. In addition to collecting user data in business, various Internet application services also provide rich data resources. Various Internet applications usually provide resource entrances through domain names. Before locating specific application servers, domain names need to be converted to IP addresses. When users browse web pages or use apps, they use the domain name resolution system (DNS) to obtain the IP address of the server before the application connects to the application server. When users obtain the IP address of the access server through the DNS service, the local DNS server generally records the process and generates the corresponding domain name resolution log. The domain name resolution log contains a lot of user access information, which can be used in subsequent data analysis after cleaning and processing. In the existing materials, there are many applications for DNS resolution logs, such as discovering malicious websites and checking whether the host status of the internal network is abnormal. The domain name resolution log generated by the DNS server does not pay attention to the online and offline status of the device, and the data granularity is very coarse. If the record can be refined, it can provide more abundant information for subsequent data analysis. Summary of the invention

[0003] The purpose of the present invention is to provide a system, method, electronic device and storage medium for generating a domain name item set for device access by a router, so as to solve the problem that the domain name resolution log generated by the DNS server in the prior art does not pay attention to the online and offline status of the device and the data granularity is very coarse.

[0004] The present invention solves the above problems through the following technical solutions:

[0005] A system for generating a device access domain name item set by a router, comprising:

[0006] The message parsing module is used to monitor network messages, filter DNS request messages, parse and reassemble the messages, and then send the domain name record message to the message monitoring and data processing module;

[0007] The message monitoring and data processing module is used to detect the status of the terminal devices connected to the router, and to perform data processing after monitoring the domain name record message sent by the message resolution module, and store the DNS request data records of the matching connected terminal devices and the domain name data of all DNS request resolutions during the online period of the terminal device.

[0008] A method for a router to generate a device access domain name item set, comprising:

[0009] Step S1, monitor network messages, filter DNS request messages, parse and reassemble the messages, and then send domain name record messages;

[0010] Step S2: Real-time detection of the status of the terminal device under the router, after monitoring the domain name record message, data processing is performed, and the DNS request data record of the matching terminal device under the router and the domain name data resolved by all DNS requests during the online period of the terminal device are stored.

[0011] Furthermore, the step S1 specifically includes:

[0012] Use the NETFILTER framework to add a hook function to monitor network messages. In the hook function, filter DNS request messages by judging the network protocol and destination port of the data frame.

[0013] For the filtered message, the source MAC address, epoch time and the domain name requested for query in the message are parsed, the three fields are organized into a string of a set format, and a domain name record message is sent through a NETLINK message.

[0014] Furthermore, the method for detecting the status of the terminal device connected to the router in step S2 is: when the terminal device is connected to the router, the MAC address of the terminal device is recorded, and periodic checking is performed to see whether the terminal device is online.

[0015] Furthermore, in step S2, after monitoring the domain name record message, data processing is performed, and the method for storing the DNS request data record of the matching downstream terminal device and the domain name data resolved by all DNS requests during the online period of the terminal device is:

[0016] After monitoring the sent domain name record message, obtain the MAC address in the message, check whether the MAC address is in the downstream terminal device connected to the router, if there is a matching downstream terminal device, generate a DNS request data record in the data storage chain table corresponding to the terminal device MAC, the fields of the DNS request data record include the epoch time of the DNS request and the domain name address requested for resolution, while the downstream terminal device is online, all domain name data resolved by the DNS request are stored in the chain table in a fixed format, when it is detected that the terminal device is disconnected from the router, read the data in the storage chain table of the terminal device, and organize it into a data record, the record includes the unique code (uuid) of the record, the terminal device MAC (station mac), the router MAC (router mac), the record generation time (time), the device online time (connect time) and the offline time (off time), the number of domain name items (item number) and the item set composed of domain names (items), where the item set composed of domain names includes the domain name (domain) and epoch time (Epoch Time) fields;

[0017] After the data records are sorted, the data is stored in the remote database. The database uses two tables to store the records. One table is the access record table (Record Table), which records the access information of the terminal device, including the record primary key (uuid), the terminal device MAC (station mac), the router MAC (router mac), the record generation time (time), the device online time (connect time) and offline time (off time) and the number of domain name items (item number) recorded; the other table is the access detail table (Detail Domain Table), which records the details of the domain name visited. The primary key (uuid) in the access record table is used as the foreign key, and each domain name (domain) and epoch time (Epoch Time) are stored as a record. The number of records corresponds to the number of domain name items (item number) in the access record table.

[0018] After the data is stored in the database, the linked list and data corresponding to the terminal device are released, and the terminal device is deleted from the maintained online terminal device list, completing the domain name access record of the terminal device from connecting to the router to disconnecting, and generating an item set of domain names accessed by the terminal device during the online period.

[0019] An electronic device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the method for generating a device access domain name item set by a router is implemented when the processor executes the computer program.

[0020] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the method for a router generating device to access a domain name item set.

[0021] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0022] (1) The present invention can generate a set of record items for the domain name that each terminal device initiates a DNS resolution request from the time period when it is connected to or disconnected from the router. The record fields generated by this method include the terminal device MAC (station mac), the router MAC (router mac) to which the terminal is connected, the record generation time (time), the terminal device online time (connect time) and offline time (off time), the domain name (domain) that the terminal requests for resolution and the epoch time (Epoch Time) of the request, etc., focusing on the online and offline status of the device, and the data granularity is refined, which can provide richer information for subsequent data analysis work.

[0023] (2) The present invention obtains the DNS request record of each terminal device in the local network, performs structured processing on the DNS request record, generates a domain name access record item set, converts the domain name item set into a database record, and stores it in a remote database. DETAILED DESCRIPTION

[0024] The present invention is further described in detail below in conjunction with examples, but the embodiments of the present invention are not limited thereto.

[0025] Embodiment 1:

[0026] A system for generating a device access domain name item set by a router, comprising:

[0027] The message parsing module is used to monitor network messages, filter DNS request messages, parse and reassemble the messages, and then send the domain name record message to the message monitoring and data processing module;

[0028] The message parsing module is in the kernel module of the router. The DNS request is transmitted via the UDP protocol. According to the characteristics of the DNS message, the present invention uses the NETFILTER framework and adds a hook function to monitor the network message. DNS uses the UDP protocol, and the message destination address is port 53. In the hook function, the DNS request message is filtered by judging the network protocol and destination port of the data frame. The source MAC address, epoch time, and domain name (queries) requested in the message are parsed. After collecting the fields in the DNS request packet, these three fields are organized into a fixed-format string and sent to the message monitoring and data processing module via the NETLINK message. The message monitoring and data processing module is in the application layer of the router.

[0029] The message monitoring and data processing module is used to detect the status of the terminal devices connected to the router, and to perform data processing after monitoring the domain name record message sent by the message resolution module, and store the DNS request data records of the matching connected terminal devices and the domain name data of all DNS request resolutions during the online period of the terminal device.

[0030] The message monitoring and data processing module is responsible for checking the status of the downstream terminal, monitoring the domain name record messages sent, and reprocessing and handling the data.

[0031] When a terminal device is connected to the router, the MAC address of the terminal is recorded and periodic checks are performed to see if the terminal is online.

[0032] After listening to the domain name record message sent by the kernel module, the MAC address in the message is parsed to check whether the MAC address is in the terminal device connected to the router. If there is a matching device, a DNS request data record is generated and stored in the data storage chain corresponding to the MAC of the device. The fields of the record include the epoch time of the DNS request, the domain name address requested for resolution, etc. During the period when the terminal device is online, all domain name data resolved by the DNS request are stored in the chain in a fixed format. When it is detected that the terminal device is disconnected from the router, the application reads the data in the storage chain of the device and organizes it into a data record. The record includes the unique code (uuid) of the record, the terminal device MAC (station mac), the router MAC (router mac), the record generation time (time), the device online time (connect time) and offline time (off time), the number of domain name items in the record (item number) and the item set composed of domain names (items). The domain name item includes the domain name (domain) and epoch time (Epoch Time) fields. After the data records are sorted, the data is stored in the remote database. The database uses two tables to store the records. One table is the access record table (Record Table), which records the access information of the terminal device, including the record primary key (uuid), the terminal device MAC (station mac), the router MAC (router mac), the record generation time (time), the device online time (connecttime) and offline time (off time), and the number of domain name items (item number) recorded; the other is the access detail table (Detail Domain Table), which records the details of the domain name visited, using the primary key (uuid) in the access record table as the foreign key, and storing each domain name (domain) and epoch time (Epoch Time) into a record. The number of records corresponds to the number of domain name items (item number) in the access record table. After the data is stored in the database, the application releases the linked list and data corresponding to the device, and deletes the device from the maintained online device list.

[0033] The fields of the database records are shown in Table 1 and Table 2 below:

[0034] Table 1 Access record table (Record Table)

[0035] Field Name content uuid Primary Key SourceMac Device MAC routermac Router's MAC itemnumber The number of items contained in the itemset connecttime Device connection time disconnecttime Device offline time

[0036] Table 2 Detail Domain Table

[0037] Field Name content r_uuid Foreign key, access the primary key (uuid) in the record table domainname Domain Name Item epochtime Epoch time

[0038] Embodiment 2:

[0039] A method for a router to generate a device access domain name item set, comprising:

[0040] Step S1, monitor network messages, filter DNS request messages, parse and reassemble the messages, and then send domain name record messages;

[0041] Step S2: Real-time detection of the status of the terminal device under the router, after monitoring the domain name record message, data processing is performed, and the DNS request data record of the matching terminal device under the router and the domain name data resolved by all DNS requests during the online period of the terminal device are stored.

[0042] Furthermore, the step S1 specifically includes:

[0043] Use the NETFILTER framework to add a hook function to monitor network messages. In the hook function, filter DNS request messages by judging the network protocol and destination port of the data frame.

[0044] For the filtered message, the source MAC address, epoch time and the domain name requested for query in the message are parsed, the three fields are organized into a string of a set format, and a domain name record message is sent through a NETLINK message.

[0045] Furthermore, the method for detecting the status of the terminal device connected to the router in step S2 is: when the terminal device is connected to the router, the MAC address of the terminal device is recorded, and periodic checking is performed to see whether the terminal device is online.

[0046] Furthermore, in step S2, after monitoring the domain name record message, data processing is performed, and the method for storing the DNS request data record of the matching downstream terminal device and the domain name data resolved by all DNS requests during the online period of the terminal device is:

[0047] After monitoring the sent domain name record message, obtain the MAC address in the message, check whether the MAC address is in the downstream terminal device connected to the router, if there is a matching downstream terminal device, generate a DNS request data record in the data storage linked list corresponding to the MAC of the terminal device, the fields of the DNS request data record include the epoch time of the DNS request and the domain name address requested for resolution, while the downstream terminal device is online, all domain name data resolved by the DNS request are stored in the linked list in a fixed format, when it is detected that the terminal device is disconnected from the router, read the data in the storage linked list of the terminal device, and organize it into a data record, the record includes the unique code of the record, the terminal device MAC, the router MAC, the record generation time, the device online time and offline time, the number of domain name items in the record and the item set composed of the domain name, wherein the item set composed of the domain name includes the domain name and epoch time fields;

[0048] After the data records are sorted, they are stored in a remote database. The database uses two tables to store the records. One table is the access record table, which records the access information of the terminal device, including the record primary key, terminal device MAC, router, record generation time, device online time and offline time, and the number of domain name items recorded; the other table is the access details table, which records the details of the domain name visited. The primary key in the access record table is used as a foreign key to store each domain name and epoch time into a record. The number of records corresponds to the number of domain name items in the access record table.

[0049] After the data is stored in the database, the linked list and data corresponding to the terminal device are released, and the terminal device is deleted from the maintained online terminal device list, completing the domain name access record of the terminal device from connecting to the router to disconnecting, and generating an item set of domain names accessed by the terminal device during the online period.

[0050] The present invention parses the DNS request information of the terminal under the router through the NETFILTER framework and performs structured processing on the data, generates an item set for the domain name items of the request resolution during the online period when the terminal device is connected to the router, and uniformly stores the item sets generated by all routers in the internal network in a remote database to facilitate subsequent information analysis.

[0051] An electronic device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the method for generating a device access domain name item set by a router is implemented when the processor executes the computer program.

[0052] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the method for a router generating device to access a domain name item set.

[0053] Although the present invention is described herein with reference to the illustrative embodiments of the present invention, the above embodiments are only preferred embodiments of the present invention, and the embodiments of the present invention are not limited to the above embodiments. It should be understood that those skilled in the art can design many other modifications and embodiments, which will fall within the scope and spirit of the principles disclosed in this application.

Claims

1. A system for generating a router device access domain name item set, characterized in that: include: The message parsing module is used to monitor network messages, filter DNS request messages, parse and reassemble the messages, and then send the domain name record message to the message monitoring and data processing module; The message monitoring and data processing module is used to detect the status of the terminal devices connected to the router, and to perform data processing after monitoring the domain name record message sent by the message resolution module, and store the DNS request data records of the matching connected terminal devices and the domain name data of all DNS request resolutions during the online period of the terminal device.

2. A method for generating a device access domain name item set by a router, characterized in that: include: Step S1, monitor network messages, filter DNS request messages, parse and reassemble the messages, and then send domain name record messages; Step S2: Real-time detection of the status of the terminal device under the router, after monitoring the domain name record message, data processing is performed, and the DNS request data record of the matching terminal device under the router and the domain name data resolved by all DNS requests during the online period of the terminal device are stored.

3. The method for generating a domain name item set accessed by a router according to claim 2, characterized in that: The step S1 specifically includes: Use the NETFILTER framework to add a hook function to monitor network messages. In the hook function, filter DNS request messages by judging the network protocol and destination port of the data frame. For the filtered message, the source MAC address, epoch time and the domain name requested for query in the message are parsed, the three fields are organized into a string of a set format, and a domain name record message is sent through a NETLINK message.

4. The method for generating a domain name item set accessed by a router according to claim 3, characterized in that: The method for detecting the status of the terminal device connected to the router in step S2 is: when the terminal device is connected to the router, the MAC address of the terminal device is recorded, and periodic checking is performed to see whether the terminal device is online.

5. The method for generating a router device access domain name item set according to claim 4, characterized in that: In step S2, after monitoring the domain name record message, data processing is performed, and the method for storing the DNS request data record of the matching downstream terminal device and the domain name data resolved by all DNS requests during the online period of the terminal device is: After monitoring the sent domain name record message, obtain the MAC address in the message, check whether the MAC address is in the downstream terminal device connected to the router, if there is a matching downstream terminal device, generate a DNS request data record in the data storage linked list corresponding to the MAC of the terminal device, the fields of the DNS request data record include the epoch time of the DNS request and the domain name address requested for resolution, while the downstream terminal device is online, all domain name data resolved by the DNS request are stored in the linked list in a fixed format, when it is detected that the terminal device is disconnected from the router, read the data in the storage linked list of the terminal device, and organize it into a data record, the record includes the unique code of the record, the terminal device MAC, the router MAC, the record generation time, the device online time and offline time, the number of domain name items in the record and the item set composed of the domain name, wherein the item set composed of the domain name includes the domain name and epoch time fields; After the data records are sorted, they are stored in a remote database. The database uses two tables to store the records. One table is the access record table, which records the access information of the terminal device, including the record primary key, the terminal device MAC, the router MAC, the record generation time, the device online time and offline time, and the number of domain name items recorded; the other table is the access details table, which records the details of the domain name visited. The primary key in the access record table is used as a foreign key to store each domain name and epoch time into a record. The number of records corresponds to the number of domain name items in the access record table. After the data is stored in the database, the linked list and data corresponding to the terminal device are released, and the terminal device is deleted from the maintained online terminal device list, completing the domain name access record of the terminal device from connecting to the router to disconnecting, and generating an item set of domain names accessed by the terminal device during the online period.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method for a router to generate a device accessing a domain name item set as described in any one of claims 2 to 5 is implemented.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for a router generating device to access a domain name item set according to any one of claims 2 to 5 is implemented.