Domain name identification library updating method and system, domain name identification method and server

Abstract

The invention discloses a domain name recognition library updating method and system, a domain name recognition method and a server, and the method comprises the steps: mapping a to-be-recognized domain name, and comparing the to-be-recognized domain name with the domain name recognition library to determine which mapping domain name of the to-be-recognized domain name is the same as that in the domain name recognition library when the domain name recognition library is updated; whether the domain name to be identified is legal or not can be determined according to the type of the domain name corresponding to the matched mapping domain name, so that the requirement of determining whether the domain name to be identified is legal or not when the domain name identification library is automatically updated can be effectively met; the domain name is mapped through the ordered list and the mapping dictionary, the domain name similarity can be rapidly detected, complex mathematical principles are not needed, development is facilitated, complex calculation processes are not needed, the calculation efficiency is high, the processing rate is high, the requirement for recognizing a large number of domain names can be met, and the updating rate of a domain name recognition library can be improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a domain name identification library updating method, system, domain name identification method and server. Background Art

[0002] A domain name is composed of two or more groups of ASCII or national language characters, and each character group is separated by a period. The rightmost character group is called the top-level domain name or the first-level domain name, the second-to-last character group is called the second-level domain name, the third-to-last character group is called the third-level domain name, and so on.

[0003] Top-level domain names: They are divided into three categories: the first is the country and regional top-level domain names, such as .cn for China and .jp for Japan; the second is the generic top-level domain names, such as .com for industrial and commercial enterprises and .net for network providers; the third is the new top-level domain names, such as the generic .xyz and .top representing "high-end".

[0004] On the Internet, there are often various illegal domain names or situations where other people's domain names are counterfeited to achieve illegal purposes. Therefore, it is very important to detect whether the domain name is legal or not.

[0005] When performing domain name identification, as shown in the patent document with authorization announcement number CN112751804B, the domain name to be identified is usually compared with a determined domain name library in whole or in part for identification.

[0006] Therefore, the domain name database is the basis for accurate identification, and the data in the domain name database needs to be updated in a timely manner. However, the existing update method can only add the newly acquired domain names to the domain name database, but cannot automatically identify whether each newly added domain name is legal. Summary of the invention

[0007] The purpose of the present invention is to solve the above problems existing in the prior art and to provide a domain name identification library updating method, system, domain name identification method and server.

[0008] The purpose of the present invention is achieved through the following technical solutions: The domain name identification database updating method comprises the following steps: S1, obtain a batch of domain names to be identified; S2, identify each domain name to be identified according to the following process; S21, determining a to-be-identified mapped domain name corresponding to a to-be-identified domain name according to the determined ordered list and mapping method; S22, the mapped domain name to be identified and the mapped domain name in the domain name identification library are compared to determine whether the mapped domain name to be identified matches a mapped domain name in the domain name identification library; if not, execute S23; if so, execute S24; S23, adding the domain name to be identified to a domain name library to be classified; S24, determine whether the types of all domain names corresponding to the mapped domain name in the match are consistent, if so, execute S25, if not, execute S26; the type of a domain name refers to whether a domain name is a legal domain name or an illegal domain name; S25, adding the domain name to be identified to the domain name identification library, and determining that the type of the domain name to be identified is the type of all domain names corresponding to the mapped domain name in the match; S26, determine the matching mapping domain name corresponding to all domain names, the proportion of legitimate domain names reaches the first threshold, if not, execute S27; if so, execute S28; S27, adding the domain name to be identified to the domain name library to be classified; S28, adding the domain name to be identified to the domain name identification library, determining that the type of the domain name to be identified is a legal domain name and adding a doubtful mark to the domain name to be identified; S3, after all the domain names to be identified are identified, confirm the proportion of doubtful domain names corresponding to each mapped domain name in the domain name identification library, the proportion of doubtful domain names corresponding to a mapped domain name is the proportion of domain names with doubtful marks among all the domain names corresponding to the mapped domain name; when it is determined that the proportion of doubtful domain names corresponding to a mapped domain name exceeds a second threshold, transfer the domain names with doubtful marks among all the domain names corresponding to the mapped domain name from the domain name identification library to the domain name library to be classified, and obtain an updated domain name library to be classified and a domain name identification library.

[0009] Preferably, the ordered list comprises letters and / or numbers and / or symbols arranged in order, and there is only one of each letter and / or number and / or symbol.

[0010] Preferably, determining the mapped domain name to be identified corresponding to the domain name to be identified according to the determined ordered list and mapping method comprises the following process: S211, establishing a mapping dictionary for the domain name to be identified, which is initially empty and updated according to a predetermined rule; S212, taking all or part of the character groups in the domain name to be identified as the domain name to be mapped, and mapping all characters to be mapped except the period in the domain name to be mapped from left to right or from right to left according to the ordered list and the mapping dictionary to obtain target mapping characters for each character to be mapped; S213, mapping all the characters to be mapped in the domain name to be mapped into corresponding target mapping characters and combining them with the original periods in the domain name to be identified in their original order in the domain name to be identified to obtain the mapped domain name to be identified.

[0011] Preferably, in S212, the top-level domain name in the domain name to be identified is removed and used as the domain name to be mapped; In S213, all characters to be mapped in the domain name to be mapped are mapped to corresponding target mapping characters and then combined with the original top-level domain name and period in the domain name to be identified in their original order in the domain name to be identified to obtain the mapped domain name to be identified.

[0012] Preferably, before mapping, it is first determined whether the number of character types of the domain name to be mapped exceeds the number of characters in the ordered list. If so, the domain name to be mapped is trimmed so that the number of character types of the trimmed domain name to be mapped does not exceed the number of characters in the ordered list.

[0013] Preferably, in S212, when mapping each character to be mapped, first determine whether there is a mapping relationship corresponding to the character to be mapped in the mapping dictionary; If yes, mapping the to-be-mapped character to a corresponding target mapping character according to the mapping relationship; If not, determine that the character to be mapped is the first character that appears in the domain name to be mapped, and select characters of the corresponding order from the ordered list as the target mapping characters of the character to be mapped, map the character to be mapped to the target mapping character, and store the mapping relationship between the character to be mapped and the target mapping character in the mapping dictionary.

[0014] Preferably, in S3, after obtaining the updated domain name library to be classified, a second identification method is used to determine the type of each domain name in the domain name library to be classified; Adding the domain name after the type is determined in the domain name library to be classified to the domain name identification library; The domain names whose types are not identified in the domain name library to be classified are retained in the domain name library to be classified and wait for the next comparison with the updated domain name identification library.

[0015] Domain name identification database update system, including: A domain name acquisition unit, used to acquire a batch of domain names to be identified; The identification unit is used to identify each domain name to be identified, and includes: A mapping module, used to determine a to-be-identified mapped domain name corresponding to a to-be-identified domain name according to a determined ordered list and a mapping method; A matching module, used to compare the mapping domain name to be identified with the mapping domain name in the domain name identification library to determine whether the mapping domain name to be identified matches a mapping domain name in the domain name identification library, and if not, communicate with the first classification module; if so, communicate with the second classification module; A first classification module, used for adding the domain name to be identified to a domain name library to be classified; The second classification module is used to determine whether the types of all domain names corresponding to the mapped domain name in the match are consistent. If so, it communicates with the third classification module, and if not, it communicates with the fourth classification module. The type of a domain name refers to whether a domain name is a legal domain name or an illegal domain name; A third classification module, used for adding the domain name to be identified to the domain name identification library, and determining the type of the domain name to be identified as the type of all domain names corresponding to the mapped domain name in the match; The fourth classification module is used to determine whether the proportion of legal domain names in all domain names corresponding to the mapped domain name in the match reaches the first threshold, and if not, communicate with the fifth classification module; if so, communicate with the sixth classification module; A fifth classification module, used for adding the domain name to be identified to a domain name library to be classified; a sixth classification module, configured to add the domain name to be identified to the domain name identification library, determine that the type of the domain name to be identified is a legal domain name, and add a doubtful mark to the domain name to be identified; The doubtful domain name identification unit is used to confirm the proportion of doubtful domain names corresponding to each mapped domain name in the domain name identification library after all the domain names to be identified are identified. The proportion of doubtful domain names corresponding to a mapped domain name is the proportion of domain names with doubtful marks among all the domain names corresponding to the mapped domain name; when it is determined that the proportion of doubtful domain names corresponding to a mapped domain name exceeds a second threshold, the domain names with doubtful marks among all the domain names corresponding to the mapped domain name are transferred from the domain name identification library to the domain name library to be classified, so as to obtain an updated domain name library to be classified and a domain name identification library.

[0016] A domain name identification method uses a domain name identification library obtained by any of the domain name identification library updating methods described above to identify the domain name accessed by the user.

[0017] The server includes a memory and a processor, wherein the memory stores a program executable by the processor, and when the program is executed, any of the above-mentioned domain name identification library updating methods and / or the above-mentioned domain name identification methods are implemented.

[0018] The advantages of the technical solution of the present invention are mainly reflected in: The present invention maps domain names through an ordered list and a mapping dictionary, can identify the naming mode of domain names, can use the mapped domain names to distinguish illegal domain names from legal domain names, so that when updating a domain name recognition library, the domain name to be recognized can be mapped and compared with the domain name recognition library to determine which mapped domain name of the domain name to be recognized is the same as that of the mapped domain name in the domain name recognition library, and then can determine whether the domain name to be recognized is legal according to the type of the domain name corresponding to the mapped domain name in the match, can effectively meet the requirement of determining whether the domain name to be recognized is legal when the domain name recognition library is automatically updated; and by mapping the domain names through an ordered list and a mapping dictionary, the domain name similarity detection can be quickly performed, no complex mathematical principles are required, and development is convenient, and no complex calculation process is required, and the calculation efficiency is high, the processing rate is fast, and the recognition needs of a large number of domain names can be met, which is conducive to improving the update rate of the domain name recognition library.

[0019] When the domain name identification library of the present invention is used for identifying the domain name accessed by the user, it can quickly find the domain name of the same type by mapping the domain name, so as to quickly determine whether the domain name accessed by the user is legal and perform corresponding access control, which greatly improves the processing rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 It is a process schematic diagram of the domain name identification database updating method of the present invention; Figure 2 It is a schematic diagram of the process of mapping the domain name to be identified to obtain the mapped domain name to be identified in the present invention; Figure 3 It is a schematic diagram of the process of mapping characters to be mapped and updating the mapping dictionary in the present invention; Figure 4 It is a schematic diagram of the process of removing some character groups in the domain name to be identified and then mapping to obtain the mapped domain name to be identified in the present invention. DETAILED DESCRIPTION

[0021] The purpose, advantages and features of the present invention will be illustrated and explained by the non-limiting description of the following preferred embodiments. These embodiments are only typical examples of the application of the technical solution of the present invention, and any technical solution formed by equivalent replacement or equivalent transformation falls within the scope of protection claimed by the present invention.

[0022] In the description of the scheme, it should be noted that the terms "center", "upper", "lower", "left", "right", "front", "back", "vertical", "horizontal", "inside", "outside" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the drawings, and are only for the convenience and simplification of description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first", "second", and "third" are used for descriptive purposes only, and cannot be understood as indicating or implying relative importance.

[0023] Example 1 The domain name identification database updating method disclosed by the present invention is described below in conjunction with the accompanying drawings. Figure 1 As shown, it includes the following steps: S1, obtain a batch of domain names to be identified; S2, identify each domain name to be identified according to the following process; S21, determining a to-be-identified mapped domain name corresponding to a to-be-identified domain name according to the determined ordered list and mapping method; S22, compare the mapped domain name to be identified with the mapped domain names in the domain name identification library to determine whether the mapped domain name to be identified matches a mapped domain name in the domain name identification library; if not, execute S23; if yes, execute S24; the type of a domain name refers to whether a domain name is a legal domain name or an illegal domain name; S23, adding the domain name to be identified to a domain name library to be classified; S24, determine whether the types of all domain names corresponding to the matching mapped domain names are consistent, and if so, execute S25, if not, execute S26; S25, adding the domain name to be identified to the domain name identification library, and determining that the type of the domain name to be identified is the type of all domain names corresponding to the mapped domain name in the match; S26, determine the matching mapping domain name corresponding to all domain names, the proportion of legitimate domain names reaches the first threshold, if not, execute S27; if so, execute S28; S27, adding the domain name to be identified to the domain name library to be classified; S28, adding the domain name to be identified to the domain name identification library, determining that the type of the domain name to be identified is a legal domain name and adding a doubtful mark to the domain name to be identified; S3, after all the domain names to be identified are identified, confirm the proportion of doubtful domain names corresponding to each mapped domain name in the domain name identification library, the proportion of doubtful domain names corresponding to a mapped domain name is the proportion of domain names with doubtful marks among all the domain names corresponding to the mapped domain name; when it is determined that the proportion of doubtful domain names corresponding to a mapped domain name exceeds a second threshold, transfer the domain names with doubtful marks among all the domain names corresponding to the mapped domain name from the domain name identification library to the domain name library to be classified, and obtain an updated domain name library to be classified and a domain name identification library.

[0024] In S1, the domain name to be identified can be obtained from the traffic data obtained according to a certain period, for example, it can be obtained from the traffic data obtained in one day at a fixed time every day, for example, at 24 o'clock every day, a batch of domain names to be identified are obtained from the traffic data of one day. When obtaining the domain name to be identified, a packet capture tool can be set on the gateway, and the packet capture tool can capture the network message data on this gateway, and at the same time, the domain name information can be parsed from the message data. When performing various Internet operations under this gateway, the corresponding domain name information can be obtained, that is, the domain name to be identified is obtained. The domain name to be identified can also be a domain name stored in a domain name library to be classified. After the domain name identification library is updated and expanded for a predetermined number of times, the updated domain name identification library is used to compare again with the domain names in the domain name library to be classified, so that the domain names in the domain name library to be classified can be added to the domain name identification library.

[0025] In S21, the determined ordered list includes letters and / or numbers and / or symbols arranged in order, the letters can be uppercase and lowercase letters of the 26 English letters, Greek letters, etc., the numbers can be Arabic numerals, Roman numerals, Chinese numerals, etc., the symbols can be mathematical symbols, punctuation marks, etc., and each letter and / or number and / or symbol has only one.

[0026] For example, the ordered list is defined as follows: [a,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z,0,1,2,3,4,5,6,7,8,9].

[0027] As attached Figure 2 As shown, determining the mapped domain name to be identified corresponding to the domain name to be identified according to the determined ordered list and mapping method includes the following process: S211, establishing a mapping dictionary for the domain name to be identified, which is initially empty and updated according to a predetermined rule; S212, taking all or part of the character groups in the domain name to be identified as the domain name to be mapped, and mapping all characters to be mapped except the period in the domain name to be mapped from left to right or from right to left according to the ordered list and the mapping dictionary to obtain target mapping characters for each character to be mapped; As attached Figure 3 As shown, when mapping each character to be mapped in sequence, first determine whether there is a mapping relationship corresponding to the character to be mapped in the mapping dictionary; If yes, mapping the to-be-mapped character to a corresponding target mapping character according to the mapping relationship; If not, determine that the character to be mapped is the first character that appears in the domain name to be mapped, and select characters of the corresponding order from the ordered list as the target mapping characters of the character to be mapped, map the character to be mapped to the target mapping character, and store the mapping relationship between the character to be mapped and the target mapping character in the mapping dictionary.

[0028] S213, mapping all the characters to be mapped in the domain name to be mapped into corresponding target mapping characters and combining them with the original periods in the domain name to be identified in their original order in the domain name to be identified to obtain the mapped domain name to be identified.

[0029] As attached Figure 4 As shown, in order to reduce the mapping workload, in S212, the top-level domain name in the domain name to be identified is removed and used as the domain name to be mapped; In S213, all characters to be mapped in the domain name to be mapped are mapped to corresponding target mapping characters and then combined with the original top-level domain name and period in the domain name to be identified in their original order in the domain name to be identified to obtain the mapped domain name to be identified.

[0030] For example, define the following domain name to be identified: weixin.qq.com. Define an empty mapping dictionary {} for the domain name to be identified, and update the mapping dictionary {} corresponding to the domain name to be identified according to the ordered list of the above example. And, after removing the top-level domain name in the domain name to be identified, determine that its corresponding domain name to be mapped is weixin.qq.

[0031] When mapping starts, it is determined that the first character to be mapped in the domain name to be mapped is "w", and there is no corresponding mapping relationship for the character to be mapped in the corresponding mapping dictionary {}. Therefore, it is determined that the character to be mapped "w" is the first character to be mapped that appears for the first time in the domain name to be mapped. According to the domain name to be mapped, it can be determined that "w" is the first character to be mapped that appears for the first time. Then, the first character "a" is selected from the ordered list as its target mapping character, thereby establishing a mapping relationship between the character to be mapped "w" and the target mapping character "a", and the mapping relationship is stored in the mapping dictionary {} to obtain an updated mapping dictionary {w:a}. The second character to be mapped is "e", which also does not have a mapping relationship in the updated mapping dictionary. Since it is the second character to be mapped that appears for the first time in the domain name to be mapped, the second character "b" is selected from the ordered list as the target mapping character for the character to be mapped "e", thereby determining the mapping relationship between the character to be mapped "e" and the target mapping character "b", and storing the mapping relationship in the mapping dictionary to obtain an updated mapping dictionary {w:a,e:b}. By analogy, the mapping dictionary finally updated for the domain name to be mapped is {w:a,e:b,i:c,x:d,n:e,q:f}, and the mapped characters are abcdceff. The mapped domain name to be identified is obtained by combining the mapped characters with the original period and top-level domain name in their original order in the domain name to be identified, which is abcdce.ff.com.

[0032] Further, in order to reduce the amount of calculation, the number of characters in the ordered list is limited, for example, preferably 36 characters in the above example. Correspondingly, if the number of character types of a domain name to be mapped exceeds 36, the characters in excess cannot be accurately mapped. Therefore, in S212, before mapping, it is first determined whether the number of character types of the domain name to be mapped exceeds the number of characters in the ordered list. If so, the domain name to be mapped is trimmed so that the number of character types of the domain name to be mapped after trimming does not exceed the number of characters in the ordered list. That is, if the number of character types of the domain name to be mapped exceeds 36, the domain name to be mapped needs to be trimmed so that the number of character types does not exceed 36. When trimming the domain name to be mapped, the second-level domain name and the third-level domain name are preferentially retained. This is because the second-level domain name and the third-level domain name generally reflect the company to which the domain name belongs. The domain name specification method of a single company is generally consistent and the corresponding type should also be consistent. Therefore, retaining the second-level domain name and the third-level domain name is conducive to ensuring a certain degree of accuracy.

[0033] In S22, in the initial state, the domain names stored in the domain name identification library are domain names that have been manually confirmed, that is, each domain name in the domain name identification library has been manually visited and the type of the domain name has been determined, the type of the domain name, that is, whether the domain name is a legal domain name or an illegal domain name, the legal domain name is a domain name whose content meets the legal requirements, and the illegal domain name is a domain name whose content does not meet the legal requirements.

[0034] The domain names stored in the domain name identification library include legal domain names and illegal domain names. At the same time, each domain name in the domain name identification library has been mapped to its corresponding mapping domain name according to the above-mentioned ordered list and mapping method. Each domain name will correspond to a mapping domain name, and a mapping domain name may correspond to multiple different domain names.

[0035] The information stored in the domain name identification library includes domain names, their corresponding mapping domain names, types and tag information.

[0036] Furthermore, the domain name identification library may also store the legality information corresponding to each mapped domain name, and the legality information is determined according to the types of all domain names corresponding to the mapped domain name, for example: If all domain names corresponding to a mapped domain name are legal domain names, the legality information corresponding to the mapped domain name is legal; otherwise, if all domain names corresponding to a mapped domain name are illegal domain names, the legality information corresponding to the mapped domain name is illegal.

[0037] If all domain names corresponding to a mapped domain name include both legal domain names and illegal domain names, the legality information corresponding to the mapped domain name is the proportion of legal domain names and / or the proportion of illegal domain names.

[0038] At the same time, the mapped domain names can be divided into different domain name identification libraries according to the legality information of each mapped domain name. For example, if the legality information corresponding to the mapped domain name is illegal, such mapped domain names and their corresponding domain names are all stored in an illegal domain name identification library, so that the domain names in the illegal domain name identification library are all illegal. If the legality information corresponding to the mapped domain name is legal, such mapped domain names and their corresponding domain names are all stored in a legal domain name identification library, so that the domain names in the legal domain name identification library are all legal. If the legality information corresponding to the mapped domain name is the percentage of legal domain names and / or the percentage of illegal domain names, such mapped domain names and their corresponding domain names are stored in a suspicious domain name identification library.

[0039] When subsequently identifying the domain name accessed by the user, the mapped domain name to be identified corresponding to the domain name to be identified can be matched with the illegal domain name identification library first. If no match is found, it can be matched with the suspicious domain name identification library. If no match is found, it can be matched with the legal domain name identification library. This is conducive to more quickly determining whether the domain name accessed by the user is an illegal domain name.

[0040] The following example illustrates how to determine whether a mapped domain name to be identified matches a mapped domain name in the domain name identification library. For example, the mapped domain name to be identified of a domain name to be identified hhqq789.com is aabbcde.com. If the mapped domain name of a domain name yyll456.com stored in the domain name identification library is aabbcde.com, that is, the mapped domain name stored in the domain name identification library is consistent with the mapped domain name to be identified. Therefore, the mapped domain name to be identified aabbcde.com of the domain name to be identified hhqq789.com matches a mapped domain name in the domain name identification library.

[0041] For another example, the mapping domain name to be identified of the above-mentioned domain name to be identified weixin.qq.com is abcdce.ff.com. If there is no mapping domain name identical to the domain name to be mapped abcdce.ff.com in the domain name identification library, it is determined that the domain name to be mapped abcdce.ff.com does not match the mapping domain name in the domain name identification library.

[0042] In S23, when the domain name to be identified is added to the domain name library to be classified, the domain name to be identified and its corresponding mapping domain name are added to the domain name library to be classified.

[0043] In S24, it is determined whether the types of all domain names corresponding to the mapped domain names in the match are consistent, that is, it is determined whether the types of all domain names corresponding to the mapped domain names in the match are the following: (1) They are all legal domain names; (2) They are all illegal domain names; (3) There are both legal and illegal domain names.

[0044] If the types of all domain names corresponding to the matched mapped domain names are legal domain names or illegal domain names, it is determined that the types of all domain names corresponding to the matched mapped domain names are consistent. Conversely, if all domain names corresponding to the matched mapped domain names include both legal domain names and illegal domain names, it is determined that the types of all domain names corresponding to the matched mapped domain names are inconsistent.

[0045] Correspondingly, in S25, assuming that all domain names corresponding to the mapped domain names in the domain name matching to be identified are legal domain names, the type of the domain name to be identified is determined to be a legal domain name; assuming that all domain names corresponding to the mapped domain names in the domain name matching to be identified are illegal domain names, the type of the domain name to be identified is determined to be an illegal domain name. When the domain name to be identified is added to the domain name identification library, the domain name to be identified, the mapped domain name and the type are all added to the domain name identification library.

[0046] In S26, the first threshold may be set as needed, for example, the first threshold is not less than 70%, and more preferably not less than 80%.

[0047] In S28, it is determined that the type of the domain name to be identified is a legal domain name, and a doubt mark is added to the domain name to be identified, which indicates that the type determined for the domain name to be identified is in doubt and needs to be determined by subsequent observation. Correspondingly, the domain name identification library also stores the mark information corresponding to each domain name, and the mark information can distinguish different information through different symbols or characters, such as using 0 and 1 to indicate whether there is doubt. Specifically, when it is determined that the type of a domain name to be identified is in doubt, the mark information corresponding to the domain name to be identified is 1, and at this time, a doubt mark is added to the domain name to be identified; conversely, when it is determined that there is no doubt about the type of a domain name to be identified, its corresponding mark information is 0.

[0048] In S3, it is confirmed in turn whether the proportion of domain names with questionable marks in all domain names corresponding to each mapped domain name in the domain name identification library exceeds the second threshold, that is, the proportion of domain names with mark information of 1 in the domain names corresponding to each mapped domain name in the domain name identification library is checked. The second threshold can be designed as needed, for example, it can be set between 10% and 20%. Taking 20% ​​as an example, if the proportion of domain names with mark information of 1 in the domain name identification library corresponding to a mapped domain name exceeds 20%, the domain names corresponding to the mark information of 1 in the domain name corresponding to the mapped domain name and related information are removed from the domain name identification library and added to the domain name library to be classified.

[0049] After completing the above steps, the updated domain name identification library and the domain name library to be classified are obtained.

[0050] Further, a second identification method is adopted to identify the domain names in the domain name library to be classified. The second identification method may be, for example, manual detection, which means manually accessing the relevant domain names and checking the page content to determine the corresponding type. If the type can be determined, the domain name, its corresponding mapping domain name and type are added to the domain name identification library. Otherwise, the domain name is retained in the domain name library to be classified and waits for re-comparison.

[0051] The second identification method can also determine the type of domain name by crawling web page content, converting the crawled web page content into vector data, and then inputting it into a trained classification model. The method of training a classification model by crawling web page content and classifying by a classification model is a known technology. For example, when the domain name is known, a script can be written in a programming language such as Python. When the script is executed, it will simulate the operation of manually accessing the website corresponding to the domain name and saving the web page content. After crawling the content of the web page, the text content, IP, IP geographical location and other information crawled from the web page are converted into vector data, and the classification model in the existing model library in Python is trained to obtain a classification model. The classification model can be, for example, a FastText model, and the classification model that has converged in training can be used for classification.

[0052] Furthermore, the domain names in the domain name library to be classified may be compared with the updated domain name identification library at a certain period, for example, once a week.

[0053] Example 2 This embodiment discloses a domain name identification database updating system, including: A domain name acquisition unit, used to acquire a batch of domain names to be identified; The identification unit is used to identify each domain name to be identified, and includes: A mapping module, used to determine a to-be-identified mapped domain name corresponding to a to-be-identified domain name according to a determined ordered list and a mapping method; A matching module, used to compare the mapping domain name to be identified with the mapping domain name in the domain name identification library to determine whether the mapping domain name to be identified matches a mapping domain name in the domain name identification library, and if not, communicate with the first classification module; if so, communicate with the second classification module; A first classification module, used for adding the domain name to be identified to a domain name library to be classified; The second classification module is used to determine whether the types of all domain names corresponding to the mapped domain names in the match are consistent. If so, it communicates with the third classification module, and if not, it communicates with the fourth classification module; A third classification module, used for adding the domain name to be identified to the domain name identification library, and determining the type of the domain name to be identified as the type of all domain names corresponding to the mapped domain name in the match; The fourth classification module is used to determine whether the proportion of legal domain names in all domain names corresponding to the mapped domain name in the match reaches the first threshold, and if not, communicate with the fifth classification module; if so, communicate with the sixth classification module; A fifth classification module, used for adding the domain name to be identified to a domain name library to be classified; a sixth classification module, configured to add the domain name to be identified to the domain name identification library, determine that the type of the domain name to be identified is a legal domain name, and add a doubtful mark to the domain name to be identified; The doubtful domain name identification unit is used to confirm the proportion of doubtful domain names corresponding to each mapped domain name in the domain name identification library after all the domain names to be identified are identified. The proportion of doubtful domain names corresponding to a mapped domain name is the proportion of domain names with doubtful marks among all the domain names corresponding to the mapped domain name; when it is determined that the proportion of doubtful domain names corresponding to a mapped domain name exceeds a second threshold, the domain names with doubtful marks among all the domain names corresponding to the mapped domain name are transferred from the domain name identification library to the domain name library to be classified, so as to obtain an updated domain name library to be classified and a domain name identification library.

[0054] Example 3 This embodiment discloses a domain name identification method, which uses the domain name identification library obtained by the domain name identification library updating method as described above to identify the domain name accessed by the user.

[0055] Specifically, after obtaining the domain name accessed by the user, the mapped domain name to be identified corresponding to the domain name accessed by the user is determined according to the determined ordered list and mapping method; then, the mapped domain name to be identified is compared with the mapped domain name in the domain name identification library to determine whether the mapped domain name to be identified matches a mapped domain name in the domain name identification library. If not, other known domain name identification methods can be used to determine whether the domain name accessed by the user is legal, for example, the above-mentioned classification model is used to determine the type of the domain name. If so, the legality of the domain name accessed by the user can be determined based on the domain name corresponding to the matched mapped domain name and / or the legality information of the matched mapped domain name.

[0056] When determining whether the domain name accessed by the user is legitimate or not according to the domain name corresponding to the mapped domain name in the match, the following process is used to determine: Determine the type of the domain name corresponding to the mapped domain name in the match, If it is determined that all domain names corresponding to the mapped domain names in the match are legal domain names, then the domain name accessed by the user is determined to be a legal domain name; If it is determined that all domain names corresponding to the mapped domain names in the match are illegal domain names, then determining that the domain name accessed by the user is an illegal domain name; If it is determined that there are both illegal domain names and legal domain names among all the domain names corresponding to the mapped domain names in the match, the domain name accessed by the user can be matched with all the illegal domain names corresponding to the mapped domain names in the match. If there is a match, the domain name accessed by the user is determined to be an illegal domain name; if there is no match, the domain name accessed by the user is matched with all the legal domain names corresponding to the mapped domain names in the match. If there is a match, the domain name accessed by the user is determined to be a legal domain name; if there is no match, the legality of the domain name accessed by the user can be determined based on the proportion of the illegal domain names and / or legal domain names. For example, when the proportion of legal domain names in the domain names corresponding to the mapped domain names in the match is greater than 80%, the domain name accessed by the user is determined to be a legal domain name. Otherwise, the domain name accessed by the user is determined to be an illegal domain name.

[0057] Alternatively, if all the legal domain names in the matching mapped domain names are not matched, the type of the domain name accessed by the user may be determined by crawling the webpage content and classifying it through a classification model.

[0058] When determining whether the domain name accessed by the user is legal or not directly based on the legal or not information corresponding to the mapped domain name in the match, the determination is made according to the following process: If it is determined that the legality information corresponding to the mapped domain name in the match is legal, then the domain name accessed by the user is determined to be a legal domain name; If it is determined that the legality information corresponding to the mapped domain name in the match is illegal, the domain name accessed by the user is determined to be an illegal domain name; If it is determined that the legality information corresponding to the mapped domain name is the percentage of legal domain names and / or the percentage of illegal domain names, the domain name accessed by the user can also be matched with all illegal domain names corresponding to the matched mapped domain name. If there is a match, it is determined that the domain name accessed by the user is an illegal domain name; if there is no match, the domain name accessed by the user is matched with all legal domain names corresponding to the matched mapped domain name. If there is a match, it is determined that the domain name accessed by the user is a legal domain name; if there is no match, it is determined whether the domain name accessed by the user is legal based on the percentage of legal domain names and / or the percentage of illegal domain names. For example, if the percentage of legal domain names is greater than 80%, it is confirmed that the domain name accessed by the user is a legal domain name. Otherwise, it is determined that the domain name accessed by the user is an illegal domain name.

[0059] This can achieve higher efficiency. Of course, both methods can be used for mutual verification to ensure accuracy.

[0060] If it is determined that the domain name accessed by the user is a legal domain name, the user is allowed to access it. Otherwise, if the domain name accessed by the user is an illegal domain name, the user is prevented from accessing the domain name through DNS interception and other means, and a corresponding prompt is issued.

[0061] This method can be used to quickly identify illegal domain names. This is because most illegal domain names use a fixed naming pattern. The above-mentioned ordered list and mapping method can quickly identify the naming pattern of illegal domain names. For example, assuming that the domain name hhqq789.com in the above example is stored in the domain name recognition library, it is an illegal domain name and the corresponding mapping domain name is aabbcde.com. Therefore, if the domain name accessed by the user is yyll456.com, its corresponding mapping domain name to be identified is also aabbcde.com. After the mapping domain name to be identified is matched with the domain name recognition library, it can be quickly confirmed that the domain name yyll456.com accessed by the user is an illegal domain name.

[0062] Example 4 This embodiment discloses a server, including a memory and a processor, wherein the memory stores a program executable by the processor, and when the program is executed, the domain name identification database updating method described above is implemented.

[0063] There are many implementation methods of the present invention, and all technical solutions formed by equivalent transformation or equivalent transformation fall within the protection scope of the present invention.

Claims

1. A method for updating a domain name identification database, characterized in that: The steps include: S1, obtain a batch of domain names to be identified; S2, identify each domain name to be identified according to the following process; S21, determining a to-be-identified mapped domain name corresponding to a to-be-identified domain name according to the determined ordered list and mapping method; S22, the mapped domain name to be identified and the mapped domain name in the domain name identification library are compared to determine whether the mapped domain name to be identified matches a mapped domain name in the domain name identification library; if not, execute S23; if so, execute S24; S23, adding the domain name to be identified to a domain name library to be classified; S24, determine whether the types of all domain names corresponding to the mapped domain name in the match are consistent, if so, execute S25, if not, execute S26; the type of a domain name refers to whether a domain name is a legal domain name or an illegal domain name; S25, adding the domain name to be identified to the domain name identification library, and determining that the type of the domain name to be identified is the type of all domain names corresponding to the mapped domain name in the match; S26, determine the matching mapping domain name corresponding to all domain names, the proportion of legitimate domain names reaches the first threshold, if not, execute S27; if so, execute S28; S27, adding the domain name to be identified to the domain name library to be classified; S28, adding the domain name to be identified to the domain name identification library, determining that the type of the domain name to be identified is a legal domain name and adding a doubtful mark to the domain name to be identified; S3, after all the domain names to be identified are identified, confirm the proportion of doubtful domain names corresponding to each mapped domain name in the domain name identification library, where the proportion of doubtful domain names corresponding to a mapped domain name is the proportion of domain names with doubtful marks among all the domain names corresponding to the mapped domain name; When it is determined that the proportion of questionable domain names corresponding to a mapped domain name exceeds a second threshold, domain names with questionable marks among all domain names corresponding to the mapped domain name are transferred from the domain name identification library to the domain name library to be classified, to obtain updated domain name library to be classified and domain name identification library.

2. The method for updating the domain name identification database according to claim 1, characterized in that: The ordered list includes letters and / or numbers and / or symbols arranged in order, and each letter and / or number and / or symbol has only one.

3. The method for updating the domain name identification database according to claim 1, characterized in that: Determining the mapped domain name to be identified corresponding to the domain name to be identified according to the determined ordered list and mapping method includes the following process: S211, establishing a mapping dictionary for the domain name to be identified, which is initially empty and updated according to a predetermined rule; S212, taking all or part of the character groups in the domain name to be identified as the domain name to be mapped, and mapping all characters to be mapped except the period in the domain name to be mapped from left to right or from right to left according to the ordered list and the mapping dictionary to obtain target mapping characters for each character to be mapped; S213, mapping all the characters to be mapped in the domain name to be mapped into corresponding target mapping characters and combining them with the original periods in the domain name to be identified in their original order in the domain name to be identified to obtain the mapped domain name to be identified.

4. The method for updating the domain name identification database according to claim 3, characterized in that: In S212, the top-level domain name in the domain name to be identified is removed and used as the domain name to be mapped; In S213, all characters to be mapped in the domain name to be mapped are mapped to corresponding target mapping characters and then combined with the original top-level domain name and period in the domain name to be identified in their original order in the domain name to be identified to obtain the mapped domain name to be identified.

5. The method for updating the domain name identification database according to claim 3, characterized in that: Before mapping, it is first determined whether the number of character types of the domain name to be mapped exceeds the number of characters in the ordered list. If so, the domain name to be mapped is trimmed so that the number of character types of the trimmed domain name to be mapped does not exceed the number of characters in the ordered list.

6. The method for updating the domain name identification database according to claim 3, characterized in that: In S212, when mapping each character to be mapped, first determine whether there is a mapping relationship corresponding to the character to be mapped in the mapping dictionary; If yes, mapping the to-be-mapped character to a corresponding target mapping character according to the mapping relationship; If not, determine that the character to be mapped is the first character that appears in the domain name to be mapped, and select characters of the corresponding order from the ordered list as the target mapping characters of the character to be mapped, map the character to be mapped to the target mapping character, and store the mapping relationship between the character to be mapped and the target mapping character in the mapping dictionary.

7. The method for updating a domain name identification database according to any one of claims 1 to 6, characterized in that: In S3, after obtaining the updated domain name library to be classified, a second identification method is used to determine the type of each domain name in the domain name library to be classified; Adding the domain name after the type is determined in the domain name library to be classified to the domain name identification library; The domain names whose types are not identified in the domain name library to be classified are retained in the domain name library to be classified and wait for the next comparison with the updated domain name identification library.

8. A domain name identification database updating system, characterized in that: include: A domain name acquisition unit, used to acquire a batch of domain names to be identified; The identification unit is used to identify each domain name to be identified, and includes: A mapping module, used to determine a to-be-identified mapped domain name corresponding to a to-be-identified domain name according to a determined ordered list and a mapping method; A matching module, used to compare the mapping domain name to be identified with the mapping domain name in the domain name identification library to determine whether the mapping domain name to be identified matches a mapping domain name in the domain name identification library, and if not, communicate with the first classification module; if so, communicate with the second classification module; A first classification module, used for adding the domain name to be identified to a domain name library to be classified; The second classification module is used to determine whether the types of all domain names corresponding to the mapped domain name in the match are consistent. If so, it communicates with the third classification module, and if not, it communicates with the fourth classification module. The type of a domain name refers to whether a domain name is a legal domain name or an illegal domain name; A third classification module, used for adding the domain name to be identified to the domain name identification library, and determining the type of the domain name to be identified as the type of all domain names corresponding to the mapped domain name in the match; The fourth classification module is used to determine whether the proportion of legal domain names in all domain names corresponding to the mapped domain name in the match reaches the first threshold, and if not, communicate with the fifth classification module; if so, communicate with the sixth classification module; A fifth classification module, used for adding the domain name to be identified to a domain name library to be classified; a sixth classification module, configured to add the domain name to be identified to the domain name identification library, determine that the type of the domain name to be identified is a legal domain name, and add a doubtful mark to the domain name to be identified; The doubtful domain name identification unit is used to confirm the proportion of doubtful domain names corresponding to each mapped domain name in the domain name identification library after all the domain names to be identified are identified. The proportion of doubtful domain names corresponding to a mapped domain name is the proportion of domain names with doubtful marks among all the domain names corresponding to the mapped domain name; when it is determined that the proportion of doubtful domain names corresponding to a mapped domain name exceeds a second threshold, the domain names with doubtful marks among all the domain names corresponding to the mapped domain name are transferred from the domain name identification library to the domain name library to be classified, so as to obtain an updated domain name library to be classified and a domain name identification library.

9. A domain name identification method, characterized in that: The domain name identification library obtained by the domain name identification library updating method as described in any one of claims 1 to 7 is used to identify the domain name accessed by the user.

10. A server, comprising a memory and a processor, wherein the memory stores a program executable by the processor, wherein: When the program is executed, the domain name identification database updating method according to any one of claims 1 to 7 and / or the domain name identification method according to claim 9 are implemented.

Images