Domain name query method and related device

Abstract

The invention relates to the technical field of domain name recognition, and discloses a domain name query method and related devices.The method comprises the steps that firstly, based on a preset first hash function, a hash value corresponding to each malicious domain name in a malicious domain name set is determined; secondly, for each hash value, performing modulus processing on the total slot number of the first hash table based on the hash value, and filling the malicious domain name corresponding to the hash value into the first hash table based on a processing result; if the Hash conflict exists in the first Hash table, determining the number of malicious domain names in slot positions of the Hash conflict in the first Hash table; according to the number of malicious domain names in slots of each hash conflict in the first hash table, the total slot number of the first hash table is increased, and whether the hash conflict exists in the first hash table after the total slot number is adjusted or not is judged again until the hash conflict does not exist in the first hash table after the total slot number is adjusted; and determining whether the to-be-queried domain name is a malicious domain name or not according to the first hash table without the hash conflict, thereby improving the accuracy of judging the to-be-queried domain name.

Description

Background Art

[0002] A domain name is an address system used to identify a specific computer or network service on the Internet. For example, www.example.com is a typical domain name that points to a specific server location. Domain names are usually converted into hash values ​​using a hash function for storage, but different domain names are prone to generate the same hash value, which results in low accuracy in querying domain names.

[0003] In recent years, with the continuous development of network technology, the use of malicious domain names has become more and more common and more covert. Attackers use malicious domain names to carry out various attacks, including but not limited to phishing, information theft, and malware distribution. These attack methods are constantly upgraded, becoming more complex and covert, resulting in traditional network security defense methods not being able to identify malicious domain names. Therefore, it is particularly important to detect domain names and take measures in advance to prevent attacks from happening. Summary of the invention

[0004] The embodiment of the present application provides a domain name query method and related devices, which improves the accuracy of identifying the domain name to be queried by constructing a unique hash slot in a first hash table for each malicious domain name in a malicious domain name set, and then using the first hash table to query the domain name to be queried.

[0005] In a first aspect, an embodiment of the present application provides a domain name query method, the method comprising: Determine, based on a preset first hash function, a hash value corresponding to each malicious domain name in the malicious domain name set; For each hash value, after performing a modulo process on the total number of slots in the first hash table based on the hash value, the malicious domain name corresponding to the hash value is filled into the first hash table based on the processing result; wherein the total number of slots in the first hash table is a prime number; If there is a hash conflict in the first hash table, determine the number of malicious domain names in the slots of the hash conflict in the first hash table; increase the total number of slots in the first hash table according to the number of malicious domain names in each slot of the hash conflict in the first hash table, and re-determine whether there is a hash conflict in the first hash table after the total number of slots is adjusted, until there is no hash conflict in the first hash table after the total number of slots is adjusted; According to the first hash table without hash conflicts, it is determined whether the domain name to be queried is a malicious domain name.

[0006] Compared with the prior art, the present application pre-sets a set of malicious domain names, constructs a first hash table according to each malicious domain name, and adjusts the total number of slots in the first hash table so that there is no hash conflict in the first hash table, that is, each malicious domain name has a unique hash slot in the first hash table, and then uses the first hash table without hash conflicts to determine whether the domain name to be queried is a malicious domain name, thereby improving the accuracy of the judgment of the domain name to be queried.

[0007] In a possible embodiment, after performing modulo processing on the total number of slots in the first hash table based on the hash value, filling the malicious domain name corresponding to the hash value into the first hash table based on the processing result includes: After performing modulo processing on the total number of slots in the first hash table based on the hash value, a target number of slots corresponding to the hash value is obtained; Fill the malicious domain name corresponding to the hash value into the target number of slots.

[0008] The present application uses the total number of slots in the first hash table to perform data processing on each hash value, and can accurately determine the target number of slots corresponding to each hash value based on the data processing result, and then accurately fill the malicious domain name corresponding to each hash value into the target number of slots.

[0009] In a possible embodiment, before increasing the total number of slots in the first hash table, the method further includes: Determine the maximum number of malicious domain names in the slots of the hash conflict in the first hash table; If the ratio of the maximum number of malicious domain names in the slots to the total number of slots is greater than a preset threshold, it is determined to increase the total number of slots in the first hash table.

[0010] The present application counts the number of malicious domain names in each hash conflict slot in the first hash table, sets the ratio of the maximum number of malicious domain names in the slot with hash conflict to the total number of slots, and then accurately determines the adjustment of the total number of slots in the first hash table.

[0011] In a possible embodiment, the method further includes: If the ratio of the maximum number of malicious domain names in the slot to the total number of slots is not greater than the preset threshold, constructing a second hash table based on a preset second hash function and all malicious domain names in each hash conflicting slot; If there is no hash conflict in the second hash table, it is determined whether the domain name to be queried is a malicious domain name according to the first hash table and the second hash table.

[0012] The present application counts the number of malicious domain names in each slot with hash conflicts in the first hash table, sets the ratio of the maximum number of malicious domain names in the slots with hash conflicts to the total number of slots, and then constructs a second hash table without hash conflicts. The first hash table and the second hash table can be used to more accurately improve the accuracy of identifying the domain name to be queried.

[0013] In a possible embodiment, the method further includes: If the second hash table has a hash conflict, after adjusting the total number of slots in the second hash table, re-determine whether the adjusted second hash table has a hash conflict, until the adjusted second hash table has no hash conflict.

[0014] The present application sets a total number of slots in the second hash table to adjust the rule so that the constructed second hash table can be free of hash conflicts.

[0015] In a possible embodiment, before determining whether the domain name to be queried is a malicious domain name according to the first hash table without hash conflicts, the method further includes: Calculate the hash value of each malicious domain name according to each third hash function in the preset third hash function set; All hash values ​​of each malicious domain name are filled into a third hash table, and whether the domain name to be queried is a malicious domain name is determined according to the third hash table.

[0016] The present application constructs a third hash table and uses the third hash table to first screen the domain name to be queried, which can reduce the workload of domain name screening, improve the efficiency of domain name screening, and increase the accuracy of domain name recognition.

[0017] In a second aspect, an embodiment of the present application provides a domain name query device, the device comprising: A hash calculation module, used to determine a hash value corresponding to each malicious domain name in the malicious domain name set based on a preset first hash function; A hash table construction module, for each hash value, performing a modulo process on the total number of slots in the first hash table based on the hash value, and filling the malicious domain name corresponding to the hash value into the first hash table based on the process result; wherein the total number of slots in the first hash table is a prime number; A hash table adjustment module is used to determine the number of malicious domain names in the slots of the hash conflict in the first hash table if there is a hash conflict in the first hash table; increase the total number of slots in the first hash table according to the number of malicious domain names in each slot of the hash conflict in the first hash table, and re-determine whether there is a hash conflict in the first hash table after the total number of slots is adjusted, until there is no hash conflict in the first hash table after the total number of slots is adjusted; The domain name query module is used to determine whether the domain name to be queried is a malicious domain name according to a first hash table in which no hash conflict exists.

[0018] In a possible embodiment, the hash table construction module is specifically used to: After performing modulo processing on the total number of slots in the first hash table based on the hash value, a target number of slots corresponding to the hash value is obtained; Fill the malicious domain name corresponding to the hash value into the target number of slots.

[0019] In a possible embodiment, the hash table adjustment module is further used to: Determine the maximum number of malicious domain names in the slots of the hash conflict in the first hash table; If the ratio of the maximum number of malicious domain names in the slots to the total number of slots is greater than a preset threshold, it is determined to increase the total number of slots in the first hash table.

[0020] In a possible embodiment, the device further includes: If the ratio of the maximum number of malicious domain names in the slot to the total number of slots is not greater than the preset threshold, constructing a second hash table based on a preset second hash function and all malicious domain names in each hash conflicting slot; If there is no hash conflict in the second hash table, it is determined whether the domain name to be queried is a malicious domain name according to the first hash table and the second hash table.

[0021] In a possible embodiment, the device further includes: If the second hash table has a hash conflict, after adjusting the total number of slots in the second hash table, re-determine whether the adjusted second hash table has a hash conflict, until the adjusted second hash table has no hash conflict.

[0022] In a possible embodiment, the device further includes: Calculate the hash value of each malicious domain name according to each third hash function in the preset third hash function set; All hash values ​​of each malicious domain name are filled into a third hash table, and whether the domain name to be queried is a malicious domain name is determined according to the third hash table.

[0023] In a third aspect, an embodiment of the present application provides a domain name query system, the system comprising: a central processing unit, a hardware accelerator and a terminal; The central processor is used to send a malicious domain name set to the hardware accelerator; The hardware accelerator is used to determine the hash value corresponding to each malicious domain name in the malicious domain name set based on a preset first hash function; for each hash value, after performing modulo processing on the total number of slots in the first hash table based on the hash value, fill the malicious domain name corresponding to the hash value into the first hash table based on the processing result; wherein the total number of slots in the first hash table is a prime number; if there is a hash conflict in the first hash table, determine the number of malicious domain names in the slots of the hash conflict in the first hash table; according to the number of malicious domain names in each slot of the hash conflict in the first hash table, increase the total number of slots in the first hash table, and re-determine whether there is a hash conflict in the first hash table after adjusting the total number of slots, until there is no hash conflict in the first hash table after adjusting the total number of slots; The terminal is used to send the domain name to be queried to the hardware accelerator; The hardware accelerator is further used to determine whether the domain name to be queried is a malicious domain name according to the first hash table without hash conflict, and send the determination result to the terminal.

[0024] In a fourth aspect, an embodiment of the present application provides an electronic device, the device comprising: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the domain name query method as described in any one of the first aspects.

[0025] In a fifth aspect, an embodiment of the present application provides a computer storage medium, wherein the computer storage medium stores a computer program, and the computer program is used to enable a computer to execute the domain name query method as described in any one of the first aspects.

[0026] In a sixth aspect, an embodiment of the present application provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the domain name query method as described in any one of the first aspects.

[0027] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. Obviously, the drawings introduced below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0029] Figure 1 A schematic diagram of an application scenario of a domain name query system provided in an embodiment of the present application; Figure 2 A flowchart of a domain name query method provided in one embodiment of the present application; Figure 3 A schematic diagram of constructing a first hash table provided in an embodiment of the present application; Figure 4 A schematic diagram of constructing a first hash table and a second hash table provided in an embodiment of the present application; Figure 5 A schematic diagram of constructing a third hash table provided in an embodiment of the present application; Figure 6 A flowchart of a domain name query system provided by an embodiment of the present application; Figure 7 A schematic diagram of the structure of a domain name query device provided in one embodiment of the present application; Figure 8 A schematic diagram of an electronic device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0030] In order to enable ordinary persons in the art to better understand the technical solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0031] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here can be implemented in an order other than those illustrated or described here. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. On the contrary, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the attached claims.

[0032] Below, some terms in the embodiments of the present application are explained to facilitate understanding by those skilled in the art.

[0033] (1) Domain Name System (DNS) query: refers to querying the Internet Protocol (IP) address corresponding to the domain name. In other words, it converts the user-readable domain name into a computer-recognizable IP address.

[0034] (2) Hash collision: This means that different key values ​​or different data get the same hash value after being calculated by the hash function. In this case, there is a hash collision between these key values ​​or data. When the hash collision in the hash table is large, the search efficiency will be low.

[0035] (3) Domain name blocking: This refers to blocking access to specified domain names on the network. For example, it can be used to prevent users from accessing known malicious websites, phishing websites, and other unsafe websites.

[0036] (4) Bypass traffic monitoring equipment: refers to a device that does not directly participate in packet forwarding in the network, captures network traffic through mirroring or test access point (TAP), and performs network traffic analysis. It can be used to detect and analyze network traffic without affecting the normal data transmission process.

[0037] A domain name is an address system used to identify a specific computer or network service on the Internet. For example, www.example.com is a typical domain name that points to a specific server location. Domain names are usually converted into hash values ​​using a hash function for storage, but different domain names are prone to generate the same hash value, which results in low accuracy in querying domain names.

[0038] In recent years, with the continuous development of network technology, the use of malicious domain names has become more and more common and more covert. Attackers use malicious domain names to carry out various attacks, including but not limited to phishing, information theft, and malware distribution. These attack methods are constantly upgraded, becoming more complex and covert, resulting in traditional network security defense methods not being able to identify malicious domain names. Therefore, it is particularly important to detect domain names and take measures in advance to prevent attacks from happening.

[0039] To this end, the present application provides a domain name query method and related devices, by pre-setting a malicious domain name set, building a first hash table according to each malicious domain name, and adjusting the total number of slots in the first hash table so that there is no hash conflict in the first hash table, that is, each malicious domain name has a unique hash slot in the first hash table, and then using the first hash table without hash conflicts to determine whether the domain name to be queried is a malicious domain name, thereby improving the accuracy of the judgment of the domain name to be queried.

[0040] After introducing the design ideas of the embodiments of the present application, the following briefly introduces the application scenarios to which the technical solutions of the embodiments of the present application can be applied. It should be noted that the application scenarios introduced below are only used to illustrate the embodiments of the present application and are not limited. In specific implementation, the technical solutions provided by the embodiments of the present application can be flexibly applied according to actual needs.

[0041] refer to Figure 1, which is a schematic diagram of an application scenario of a domain name query system provided in an embodiment of the present application. The application scenario includes: a central processor 101, a hardware accelerator 102 and a terminal 103.

[0042] First, the central processor 101 can send a malicious domain name set to the hardware accelerator 102, and then the hardware accelerator 102 determines the hash value corresponding to each malicious domain name in the malicious domain name set based on the preset first hash function; for each hash value, after the total number of slots in the first hash table is modulo processed based on the hash value, the malicious domain name corresponding to the hash value is filled into the first hash table based on the processing result; wherein the total number of slots in the first hash table is a prime number; if there is a hash conflict in the first hash table, the number of malicious domain names in the slots of the hash conflict in the first hash table is determined; according to the number of malicious domain names in the slots of each hash conflict in the first hash table, the total number of slots in the first hash table is increased, and the first hash table after the total number of slots is adjusted is re-determined whether there is a hash conflict until there is no hash conflict in the first hash table after the total number of slots is adjusted. Finally, the terminal 103 can send the domain name to be queried to the hardware accelerator 102, so that the hardware accelerator 102 determines whether the domain name to be queried is a malicious domain name based on the first hash table without hash conflict, and sends the determination result to the terminal 103.

[0043] Of course, the method provided in the embodiment of the present application is not limited to Figure 1 The application scenario shown can also be used in other possible application scenarios.

[0044] To further illustrate the technical solution provided by the embodiment of the present application, this is described in detail below in conjunction with the accompanying drawings and specific implementation methods. Although the embodiment of the present application provides the method operation steps shown in the following embodiments or drawings, more or fewer operation steps may be included in the method based on routine or no creative labor. In the steps where there is no necessary causal relationship logically, the execution order of these steps is not limited to the execution order provided by the embodiment of the present application.

[0045] Combine the following Figure 1 The application scenario shown illustrates the technical solution provided by the embodiment of the present application.

[0046] like Figure 2 As shown, an embodiment of the present application discloses a flow chart of a domain name query method, which is applied to a hardware accelerator. The method includes the following steps: S201, based on a preset first hash function, determining a hash value corresponding to each malicious domain name in a malicious domain name set.

[0047] For example, assuming that the malicious domain name set includes malicious domain name 1, malicious domain name 2, malicious domain name 3, malicious domain name 4 and malicious domain name 5, the first hash function can be a hash function with high complexity but good dispersion, for example, the first hash function is xxhash with good uniform distribution characteristics. Then, each malicious domain name can be input into the first hash function to obtain the corresponding hash value.

[0048] S202, for each hash value, perform modulo processing on the total number of slots in the first hash table based on the hash value, and fill the malicious domain name corresponding to the hash value into the first hash table based on the processing result; wherein the total number of slots in the first hash table is a prime number.

[0049] Optionally, after performing modulo processing on the total number of slots in the first hash table based on the hash value, a target number of slots corresponding to the hash value is obtained, and the malicious domain name corresponding to the hash value is filled into the target number of slots.

[0050] For example, assuming that the total number of slots in the first hash table is 43 (for example, slot number 1-slot number 43), and the hash value corresponding to the malicious domain name 1 is 1230, then the total number of slots 43 modulo processing based on the hash value 1230 can obtain a processing result of 26, that is, the target number of slots is slot number 26, so the malicious domain name 1 corresponding to the hash value 1230 is filled into the slot number 26.

[0051] Here, by setting the total number of slots in the first hash table to a prime number, hash collision problems can be reduced during the construction of the first hash table. At the same time, by using the hash value to process the total number of slots, the malicious domain name corresponding to the hash value can be more accurately filled into the first hash table.

[0052] S203, if there is a hash conflict in the first hash table, determine the number of malicious domain names in the slots of the hash conflict in the first hash table; according to the number of malicious domain names in each slot of the hash conflict in the first hash table, increase the total number of slots in the first hash table, and re-judge whether there is a hash conflict in the first hash table after the total number of slots is adjusted, until there is no hash conflict in the first hash table after the total number of slots is adjusted.

[0053] S204: Determine whether the domain name to be queried is a malicious domain name according to the first hash table in which no hash conflict exists.

[0054] For example, Figure 3 As shown, assuming that malicious domain name 1, malicious domain name 2, and malicious domain name 3 are respectively filled into the first hash table, malicious domain name 1 is in slot number 2 of the first hash table, and malicious domain name 2 and malicious domain name 3 are in slot number 4 of the first hash table. At this time, malicious domain name 2 and malicious domain name 3 form a hash conflict in slot number 4. Then the hash conflict problem of the first hash table can be solved by increasing the total number of slots in the first hash table.

[0055] Here, the total number of slots in the first hash table can be directly adjusted to twice the original total number of slots, or the total number of malicious domain names in each hash conflict slot in the first hash table can be determined, and the original total number of slots can be adjusted according to the total number of malicious domain names in all hash conflict slots. This is only an example, and the present application does not limit the specific adjustment method of increasing the total number of slots in the first hash table.

[0056] In one embodiment of the present application, by determining the maximum number of malicious domain names in the slots of the hash conflict in the first hash table, if the ratio of the maximum number of malicious domain names in the slots to the total number of slots is greater than a preset threshold, it is determined to increase the total number of slots in the first hash table.

[0057] For example, assuming that the hash conflict slot 1 in the first hash table contains malicious domain name 1 and malicious domain name 2, and the hash conflict slot 4 contains malicious domain name 3, malicious domain name 4, and malicious domain name 5, then the maximum number of malicious domain names is 3, and the ratio of the maximum number of malicious domain names in slot 4, 3, to the total number of slots, 19, is 0.16. If the preset threshold is 0.1, the hash conflict problem in the first hash table can be solved by increasing the total number of slots in the first hash table.

[0058] It should be noted that this is only an example, and the present application does not limit the specific values ​​of the maximum number of malicious domain names, the total number of slots and the preset threshold, which can be adjusted according to actual conditions.

[0059] In one embodiment of the present application, if the ratio of the maximum number of malicious domain names in the slot to the total number of slots is not greater than a preset threshold, a second hash table is constructed based on a preset second hash function and all malicious domain names in each hash conflicting slot. If there is no hash conflict in the second hash table, it is determined whether the domain name to be queried is a malicious domain name based on the first hash table and the second hash table.

[0060] Similarly, assuming that in the first hash table, slot 1 of the hash collision contains malicious domain name 1 and malicious domain name 2, and slot 4 of the hash collision contains malicious domain name 3, malicious domain name 4, and malicious domain name 5, then the maximum number of malicious domain names is 3, and the ratio of the maximum number of malicious domain names in slot 4, 3, to the total number of slots, 19, is 0.16. If the preset threshold is 1, then a second hash table without hash collision can be constructed, and then the first hash table and the second hash table can be used to jointly determine whether the domain name to be queried is a malicious domain name.

[0061] For example, Figure 4 As shown, in Figure 3On the basis of, malicious domain name 2 and malicious domain name 3 in slot number 4 can be input into a preset second hash function respectively to construct a second hash table. Here, the second hash function can be a linear function y=ax+b, and the total number of slots in the second hash table can be m. In order to accelerate convergence, a, b, and m can all be prime numbers.

[0062] In one embodiment of the present application, if there is a hash conflict in the second hash table, the total number of slots in the second hash table is adjusted, and then it is re-determined whether there is a hash conflict in the adjusted second hash table until there is no hash conflict in the adjusted second hash table.

[0063] Optionally, the hash conflict problem of the second hash table is solved by adjusting the total number of slots m of the second hash table and / or adjusting a and b of the second hash function.

[0064] The present application can reduce the number of domain names by setting a first hash table, and solve the conflict problem of the remaining domain names by setting a second hash table, thereby ensuring that there is a unique slot for each malicious domain name in a given malicious domain name set, thereby reducing the hash conflict problem.

[0065] In one embodiment of the present application, in step S204, before determining whether the domain name to be queried is a malicious domain name according to the first hash table without hash conflicts, the hash value of each malicious domain name can be calculated according to each third hash function in the preset third hash function set, and then all the hash values ​​of each malicious domain name are filled into the third hash table, and whether the domain name to be queried is a malicious domain name is determined according to the third hash table. By quickly filtering normal domain names, the number of domain names that need to be accurately matched can be reduced.

[0066] For example, Figure 5 As shown, assuming that the third hash function set includes a third hash function p, a third hash function q, and a third hash function w, inputting malicious domain name 1 into each third hash function can obtain hash value 1, hash value 2, and hash value 3, and inputting malicious domain name 2 into each third hash function can obtain hash value 4, hash value 5, and hash value 6. If each hash value randomly corresponds to the number of slots in the third hash table, for example, hash value 1-slot number 1, hash value 2-slot number 4, hash value 3-slot number 8, hash value 4-slot number 2, hash value 5-slot number 5, and hash value 6-slot number 10. And determine that the corresponding slot number is filled with identifier 1, and the non-corresponding slot number is filled with identifier 0, then the following can be obtained: Figure 5 The third hash table after being filled is shown.

[0067] It should be noted that this is only an example of how to fill in the third hash table, and the present application does not limit the specific way of filling in the third hash table.

[0068] In one embodiment of the present application, domain name blocking can be implemented at different levels of the network, generally including the following methods: Method 1: DNS level. When a user tries to access a malicious domain name, the DNS server can return an invalid IP address or redirect a secure page.

[0069] Method 2: At the Internet Protocol Suite (IPS) level, domain names are filtered to block access requests from malicious domain names.

[0070] Method three, browser level, can block malicious traffic at the browser entrance.

[0071] Method 4: At the network level, malicious domain names can be blocked by deploying security detection equipment. For example, bypass traffic monitoring equipment can be set up to split or mirror the traffic of key network devices, send the collected traffic to the bypass traffic monitoring equipment, and use the bypass traffic monitoring equipment to parse and compare the domain name to be queried. If the domain name to be queried is determined to be a malicious domain name, it can respond with an empty address.

[0072] This application achieves domain name blocking by utilizing the network layer, such as Figure 6 As shown, a flow chart of a domain name query system is disclosed. The system can be dedicated hardware or general hardware combined with software. The system includes: a central processing unit, a domain name blocking device, a network device, a recursive DNS and a terminal. Specifically, the following steps are included: S601, the central processor sends a malicious domain name set to the domain name blocking device; S602, the domain name blocking device generates a third hash table, a first hash table, and a second hash table according to the malicious domain name set; Here, the specific generation method of the third hash table, the first hash table and the second hash table can refer to the above examples, which will not be repeated here.

[0073] S603, the terminal sends a domain name query request to the network device; S604, the network device copies the domain name query request through port mirroring and sends it to the domain name blocking device and the recursive DNS; S605, the domain name blocking device parses the domain name query request, extracts the domain name to be queried, and searches the domain name to be queried using the third hash table, the first hash table, and the second hash table; if there is a search result, it searches again based on the complete string of the domain name to be queried; if there is still a search result, it constructs a domain name blocking message and sends the domain name blocking message to the terminal; Here, the specific execution process of searching the domain name to be queried by using the third hash table, the first hash table and the second hash table can refer to the above example, which will not be described in detail here.

[0074] Exemplarily, the domain name blocking device may include the hardware accelerator described above (e.g., Field-Programmable Gate Array (FPGA), Data Processing Unit (DPU)), offloading a large number of calculation processes found in step S605 to the hardware accelerator, making full use of the parallel computing capabilities of the hardware accelerator, and greatly improving the throughput and latency of the calculation steps. At the same time, the software and hardware work together and can also share the computing tasks with each other, and the overall system performance is further optimized.

[0075] S606: If there is no search result, the recursive DNS responds normally to the domain name request to be queried.

[0076] like Figure 7 As shown, an embodiment of the present application provides a domain name query device, the device comprising: A hash calculation module 701 is used to determine a hash value corresponding to each malicious domain name in the malicious domain name set based on a preset first hash function; A hash table construction module 702 is used for performing a modulo process on the total number of slots in the first hash table based on the hash value for each hash value, and then filling the malicious domain name corresponding to the hash value into the first hash table based on the processing result; wherein the total number of slots in the first hash table is a prime number; The hash table adjustment module 703 is used to determine the number of malicious domain names in the slots of the hash conflict in the first hash table if there is a hash conflict in the first hash table; increase the total number of slots in the first hash table according to the number of malicious domain names in each slot of the hash conflict in the first hash table, and re-determine whether there is a hash conflict in the first hash table after the total number of slots is adjusted, until there is no hash conflict in the first hash table after the total number of slots is adjusted; The domain name query module 704 is used to determine whether the domain name to be queried is a malicious domain name according to the first hash table without hash conflicts.

[0077] In a possible embodiment, the hash table construction module 702 is specifically used to: After performing modulo processing on the total number of slots in the first hash table based on the hash value, a target number of slots corresponding to the hash value is obtained; Fill the malicious domain name corresponding to the hash value into the target slot.

[0078] In a possible embodiment, the hash table adjustment module 703 is further used to: Determine the maximum number of malicious domain names in the slots of the hash collision in the first hash table; If the ratio of the maximum number of malicious domain names in the slots to the total number of slots is greater than a preset threshold, it is determined to increase the total number of slots in the first hash table.

[0079] In a possible embodiment, the device further includes: If the ratio of the maximum number of malicious domain names in the slot to the total number of slots is not greater than a preset threshold, constructing a second hash table based on a preset second hash function and all malicious domain names in each hash conflicting slot; If there is no hash conflict in the second hash table, it is determined whether the domain name to be queried is a malicious domain name according to the first hash table and the second hash table.

[0080] In a possible embodiment, the device further includes: If the second hash table has a hash conflict, the total number of slots in the second hash table is adjusted, and then it is determined again whether the adjusted second hash table has a hash conflict, until the adjusted second hash table has no hash conflict.

[0081] In a possible embodiment, the device further includes: Calculate the hash value of each malicious domain name according to each third hash function in the preset third hash function set; All hash values ​​of each malicious domain name are filled into the third hash table, and whether the domain name to be queried is a malicious domain name is determined according to the third hash table.

[0082] After introducing the domain name query method and related devices according to the exemplary embodiment of the present application, next, an electronic device according to another exemplary embodiment of the present application is introduced.

[0083] Those skilled in the art will appreciate that various aspects of the present application may be implemented as a system, method or program product. Therefore, various aspects of the present application may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to as "circuit", "module" or "system" herein.

[0084] In some possible implementations, the electronic device according to the present application may include at least one processor and at least one memory. The memory stores program code, and when the program code is executed by the processor, the processor executes the steps in the domain name query method according to various exemplary implementations of the present application described above in this specification. For example, the processor may execute the steps in the domain name query method.

[0085] Refer to the following Figure 8 The electronic device 80 according to this embodiment of the present application is described. Figure 8The electronic device 80 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0086] like Figure 8 As shown, the electronic device 80 is in the form of a general electronic device. The components of the electronic device 80 may include but are not limited to: at least one processor 81, at least one memory 82, and a bus 83 connecting different system components (including the memory 82 and the processor 81).

[0087] Bus 83 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, and a processor or local bus using any of a variety of bus architectures.

[0088] The memory 82 may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 821 and / or a cache memory 822 , and may further include a read-only memory (ROM) 823 .

[0089] The memory 82 may also include a program / utility 825 having a set (at least one) of program modules 824, such program modules 824 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0090] The electronic device 80 can also communicate with one or more external devices 84 (such as keyboards, pointing devices, etc.), and can also communicate with one or more devices that enable users to interact with the electronic device 80, and / or communicate with any device (such as routers, modems, etc.) that enables the electronic device 80 to communicate with one or more other electronic devices. This communication can be carried out through an input / output (I / O) interface 85. In addition, the electronic device 80 can also communicate with one or more networks (such as local area networks (LANs), wide area networks (WANs) and / or public networks, such as the Internet) through a network adapter 86. As shown in the figure, the network adapter 86 communicates with other modules for the electronic device 80 through a bus 83. It should be understood that, although not shown in the figure, other hardware and / or software modules can be used in conjunction with the electronic device 80, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0091] In an exemplary embodiment, a computer-readable storage medium including instructions is also provided, such as a memory 82 including instructions, and the instructions can be executed by the processor 81 to perform the above method. Optionally, the computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0092] In an exemplary embodiment, a computer program product is also provided, including a computer program / instruction, and when the computer program / instruction is executed by the processor 81, any method of the domain name query method provided in the present application is implemented.

[0093] In an exemplary embodiment, various aspects of a domain name query method provided by the present application may also be implemented in the form of a program product, which includes a program code. When the program product is run on a computer device, the program code is used to enable the computer device to execute the steps of a domain name query method according to various exemplary embodiments of the present application described above in this specification.

[0094] The program product may adopt any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0095] The program product for unlocking an electronic device of the embodiment of the present application may adopt a portable compact disk read-only memory (CD-ROM) and include program code, and may be run on an electronic device. However, the program product of the present application is not limited thereto, and in this document, a readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, apparatus, or device.

[0096] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein readable program code is carried. Such propagated data signals may take a variety of forms, including, but not limited to, electromagnetic signals, optical signals, or any suitable combination of the foregoing. A readable signal medium may also be any readable medium other than a readable storage medium, which may transmit, propagate, or transfer a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0097] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0098] The program code for performing the operation of the present application can be written in any combination of one or more programming languages, including object-oriented programming languages, such as Java, C++, etc., and also conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user electronic device, partially on the user device, as an independent software package, partially on the user electronic device and partially on the remote electronic device, or completely on the remote electronic device or server. In the case of a remote electronic device, the remote electronic device can be connected to the user electronic device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external electronic device (for example, using an Internet service provider to connect through the Internet).

[0099] It should be noted that, although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided into multiple units to be embodied.

[0100] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0101] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0102] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable electronic device to generate a machine, so that the instructions executed by the processor of the computer or other programmable electronic device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0103] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable electronic device to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0104] These computer program instructions may also be loaded onto a computer or other programmable electronic device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0105] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0106] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A domain name query method, characterized in that: The method comprises: Determine, based on a preset first hash function, a hash value corresponding to each malicious domain name in the malicious domain name set; For each hash value, after performing a modulo process on the total number of slots in the first hash table based on the hash value, the malicious domain name corresponding to the hash value is filled into the first hash table based on the processing result; wherein the total number of slots in the first hash table is a prime number; If there is a hash conflict in the first hash table, determine the number of malicious domain names in the slots of the hash conflict in the first hash table; increase the total number of slots in the first hash table according to the number of malicious domain names in each slot of the hash conflict in the first hash table, and re-determine whether there is a hash conflict in the first hash table after the total number of slots is adjusted, until there is no hash conflict in the first hash table after the total number of slots is adjusted; According to the first hash table without hash conflicts, it is determined whether the domain name to be queried is a malicious domain name.

2. The method according to claim 1, characterized in that After performing modulo processing on the total number of slots in the first hash table based on the hash value, filling the malicious domain name corresponding to the hash value into the first hash table based on the processing result includes: After performing modulo processing on the total number of slots in the first hash table based on the hash value, a target number of slots corresponding to the hash value is obtained; Fill the malicious domain name corresponding to the hash value into the target number of slots.

3. The method according to claim 1, characterized in that Before increasing the total number of slots in the first hash table, the method further includes: Determine the maximum number of malicious domain names in the slots of the hash conflict in the first hash table; If the ratio of the maximum number of malicious domain names in the slots to the total number of slots is greater than a preset threshold, it is determined to increase the total number of slots in the first hash table.

4. The method according to claim 3, characterized in that The method further comprises: If the ratio of the maximum number of malicious domain names in the slot to the total number of slots is not greater than the preset threshold, constructing a second hash table based on a preset second hash function and all malicious domain names in each hash conflicting slot; If there is no hash conflict in the second hash table, it is determined whether the domain name to be queried is a malicious domain name according to the first hash table and the second hash table.

5. The method according to claim 4, characterized in that The method further comprises: If the second hash table has a hash conflict, after adjusting the total number of slots in the second hash table, re-determine whether the adjusted second hash table has a hash conflict, until the adjusted second hash table has no hash conflict.

6. The method according to any one of claims 1 to 5, characterized in that: Before determining whether the domain name to be queried is a malicious domain name according to the first hash table without hash conflicts, the method further includes: Calculate the hash value of each malicious domain name according to each third hash function in the preset third hash function set; All hash values ​​of each malicious domain name are filled into a third hash table, and whether the domain name to be queried is a malicious domain name is determined according to the third hash table.

7. A domain name query device, characterized in that: The device comprises: A hash calculation module, used to determine a hash value corresponding to each malicious domain name in the malicious domain name set based on a preset first hash function; A hash table construction module, for each hash value, performing a modulo process on the total number of slots in the first hash table based on the hash value, and filling the malicious domain name corresponding to the hash value into the first hash table based on the process result; wherein the total number of slots in the first hash table is a prime number; A hash table adjustment module is used to determine the number of malicious domain names in the slots of the hash conflict in the first hash table if there is a hash conflict in the first hash table; increase the total number of slots in the first hash table according to the number of malicious domain names in each slot of the hash conflict in the first hash table, and re-determine whether there is a hash conflict in the first hash table after the total number of slots is adjusted, until there is no hash conflict in the first hash table after the total number of slots is adjusted; The domain name query module is used to determine whether the domain name to be queried is a malicious domain name according to a first hash table in which no hash conflict exists.

8. A domain name query system, characterized in that: The system comprises: a central processing unit, a hardware accelerator and a terminal; The central processor is used to send a malicious domain name set to the hardware accelerator; The hardware accelerator is used to determine the hash value corresponding to each malicious domain name in the malicious domain name set based on a preset first hash function; for each hash value, after performing modulo processing on the total number of slots in the first hash table based on the hash value, fill the malicious domain name corresponding to the hash value into the first hash table based on the processing result; wherein the total number of slots in the first hash table is a prime number; if there is a hash conflict in the first hash table, determine the number of malicious domain names in the slots of the hash conflict in the first hash table; according to the number of malicious domain names in each slot of the hash conflict in the first hash table, increase the total number of slots in the first hash table, and re-determine whether there is a hash conflict in the first hash table after adjusting the total number of slots, until there is no hash conflict in the first hash table after adjusting the total number of slots; The terminal is used to send the domain name to be queried to the hardware accelerator; The hardware accelerator is further used to determine whether the domain name to be queried is a malicious domain name according to the first hash table without hash conflict, and send the determination result to the terminal.

9. An electronic device, characterized in that: The device comprises: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the domain name query method as described in any one of claims 1 to 6.

10. A computer storage medium, characterized in that: The computer storage medium stores a computer program, and the computer program is used to enable a computer to execute the domain name query method as described in any one of claims 1 to 6.

Images