Domain name risk detection method, device, computer equipment and storage medium

Abstract

The embodiment of the present application discloses a domain name risk detection method, device, computer equipment and storage medium. The method includes: determining multiple detection nodes, and dividing the multiple detection nodes according to the geographical location information of each detection node to obtain multiple node clusters; obtaining the detection results of each detection node detecting the target domain name in each node cluster, and determining the first trust value corresponding to each detection node according to the detection results; determining the second trust value of each node cluster according to the first trust value corresponding to each detection node in each node cluster; selecting at least one target node cluster that can be trusted from multiple node clusters according to the second trust value; performing network risk detection on the domain name to be detected according to the detection nodes in at least one target node cluster, and obtaining the network risk detection result. In this way, by finding a target node cluster that can be trusted through the second trust value for network risk detection, the accuracy of network risk detection on the domain name can be improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a domain name risk detection method, device, computer equipment and storage medium. Background Art

[0002] With the development of Internet technology, each website has a corresponding domain name. In the Internet, the domain name system is used to convert human-readable domain names into computer-understandable IP addresses. This process involves resolving from the top-level domain name step by step downwards, and finally finding the IP address of the corresponding website server. If the domain name resolution service in some areas is stopped, interrupted, deleted, tampered with, etc., the website of the corresponding domain name will be inaccessible, or the website of the corresponding domain name will be hijacked, which will make it impossible to correctly access the website of the corresponding domain name.

[0003] In the related art, a large number of distributed detection nodes are deployed in different regions, and domain name resolution is achieved through a large number of distributed detection nodes. Whether the website of the corresponding domain name is safe to access is determined based on the resolution result of any detection node. However, there are a large number of distributed detection nodes, and the geographical locations of the detection nodes are relatively scattered. Due to network factors, basic resource failures or network attacks, some detection nodes fail to detect network risks for some domain names or the network risk detection results are inaccurate. Summary of the invention

[0004] The embodiments of the present application provide a domain name risk detection method, apparatus, computer equipment, and storage medium, which can improve the accuracy of network risk detection of a domain name to be detected through multiple detection nodes.

[0005] In order to achieve the above-mentioned purpose, the first aspect of the present application provides a domain name risk detection method, comprising:

[0006] Determine a plurality of detection nodes, and divide the plurality of detection nodes into a plurality of node clusters according to geographic location information of each detection node;

[0007] Acquire, in each node cluster, a detection result of each detection node detecting the target domain name, and determine a first trust value corresponding to each detection node according to the detection result;

[0008] Determining a second trust value of each node cluster according to a first trust value corresponding to each detection node in each node cluster;

[0009] selecting at least one target node cluster that can be trusted from the multiple node clusters according to the second trust value;

[0010] A network risk detection is performed on the domain name to be detected according to the detection node in the at least one target node cluster to obtain a network risk detection result.

[0011] In order to achieve the above-mentioned purpose, the second aspect of the present application provides a domain name risk detection device, including:

[0012] A first determination module is used to determine a plurality of detection nodes, and divide the plurality of detection nodes into a plurality of node clusters according to geographic location information of each detection node;

[0013] A second determination module is used to obtain a detection result of each detection node detecting the target domain name in each node cluster, and determine a first trust value corresponding to each detection node according to the detection result;

[0014] A third determination module, configured to determine a second trust value of each node cluster according to the first trust value corresponding to each detection node in each node cluster;

[0015] A selection module, configured to select at least one target node cluster that can be trusted from the multiple node clusters according to the second trust value;

[0016] The detection module is used to perform network risk detection on the domain name to be detected according to the detection node in the at least one target node cluster to obtain a network risk detection result.

[0017] In some embodiments, the second determination module includes a first acquisition submodule, a first determination submodule, a second acquisition submodule, and a second determination submodule;

[0018] A first acquisition submodule is used to acquire a response rate of each detection node detecting the target domain name;

[0019] A first determination submodule is used to determine the result consistency rate between the detection result of each detection node and the detection results of other detection nodes;

[0020] A second acquisition submodule is used to acquire a response speed of each detection node in detecting the target domain name;

[0021] The second determination submodule is used to determine the first trust value corresponding to each detection node according to the response speed, the response rate and the result consistency rate corresponding to each detection node.

[0022] In some implementations, the first acquisition submodule is used to determine, within each node cluster, a preset number of detection times performed by each detection node on the target domain name within a preset time range;

[0023] Obtaining the actual number of detections performed by each detection node on the target domain name within the preset time range;

[0024] The actual detection times of each detection node are divided by the preset detection times to obtain the detection response rate corresponding to each detection node.

[0025] In some embodiments, the second acquisition submodule is used to determine, within each node cluster, a first number of detection nodes that respond each time the target domain name is detected within a preset time range;

[0026] Determine a second number of detection nodes having detection results that are the same as the detection result of each detection node;

[0027] Dividing the second number by the first number, to obtain a sub-result consistency rate corresponding to each detection node when the target domain name is detected each time within the preset time range;

[0028] The sub-result consistency rates corresponding to each detection node when the target domain name is detected each time are added and then divided by the preset number of detections to obtain the result consistency rate between the detection result of each detection node and the detection results of other detection nodes.

[0029] In some embodiments, the second acquisition submodule is used to obtain the response delay of each detection node in the multiple node clusters each time the target domain name is detected, and determine the maximum response delay;

[0030] Subtract the response delay of each detection node from the maximum response delay and divide the result by the maximum response delay to obtain a relative response delay corresponding to each detection node;

[0031] The relative response delay corresponding to each detection node is multiplied by a preset adjustment coefficient to obtain a response speed of each detection node for detecting the target domain name.

[0032] In some implementations, the second determination submodule is used to determine the target response rate corresponding to each detection node according to the response rate and the result consistency rate corresponding to each detection node;

[0033] Determine a first weight corresponding to the target response rate and a second weight corresponding to the response speed;

[0034] Multiplying the target response rate by the first weight to obtain a first result, and multiplying the second weight by the response speed to obtain a second result;

[0035] The first result and the second result are added together to obtain a first trust value corresponding to each detection node.

[0036] In some implementations, the third determination module is used to determine multiple detection time points, and obtain the first trust value corresponding to each detection node in each node cluster at each detection time point;

[0037] The first trust value corresponding to each detection node in each node cluster at each detection time point is multiplied by the corresponding preset weight coefficient and then added to obtain the target first trust value corresponding to each detection node in each node cluster;

[0038] The target first trust value corresponding to each detection node in each node cluster is added and then divided by the total number of detection nodes used for domain name detection in each node cluster to obtain the second trust value of each node cluster.

[0039] In some embodiments, the detection module is used to input a query instruction to each detection node for domain name detection in the at least one target node cluster;

[0040] Obtaining a detection result of each detection node used for domain name detection after detecting the domain name to be detected according to the query instruction;

[0041] The network risk detection result of the domain name to be detected is determined according to the detection results of multiple detection nodes used for domain name detection.

[0042] In some implementations, the first determination module is configured to sort the plurality of node clusters from high to low according to the second trust value to obtain a sorting result;

[0043] At least one target node cluster with a higher ranking is selected from the multiple node clusters according to the ranking result.

[0044] In some embodiments, the second determination module further includes a detection submodule, which is used to determine a corresponding target detection node in each node cluster, and the target detection node is used to monitor other detection nodes in each node cluster;

[0045] In each node cluster, a detection result of each detection node except the target detection node detecting the target domain name is obtained according to the target detection node.

[0046] In some embodiments, the detection submodule is used to obtain, in each node cluster, the number of votes of each candidate detection node for the campaign target detection node, wherein the number of votes is determined based on the voting information of other detection nodes other than each candidate detection node;

[0047] The candidate detection node with the largest number of votes is determined as the target detection node.

[0048] In some implementations, the first determination module is configured to cluster the plurality of detection nodes according to the geographic location information of each detection node to obtain a plurality of geographic location categories;

[0049] Multiple detection nodes corresponding to each geographical location category are determined as a node cluster to obtain multiple node clusters.

[0050] In order to achieve the above-mentioned purpose, the third aspect of the present application provides a computer-readable storage medium, which stores multiple instructions, and the instructions are suitable for a processor to load to execute the domain name risk detection method provided in an embodiment of the present application.

[0051] In order to achieve the above-mentioned objectives, the fourth aspect of the present application provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the domain name risk detection method provided in the embodiment of the present application when executing the computer program.

[0052] In an embodiment of the present application, multiple detection nodes are determined, and multiple node clusters are obtained by dividing the multiple detection nodes according to the geographical location information of each detection node; the detection result of each detection node on the target domain name is obtained in each node cluster, and a first trust value corresponding to each detection node is determined according to the detection result; a second trust value of each node cluster is determined according to the first trust value corresponding to each detection node in each node cluster; at least one target node cluster that can be trusted is selected from the multiple node clusters according to the second trust value; network risk detection is performed on the domain name to be detected according to the detection nodes in at least one target node cluster, and a network risk detection result is obtained. In this way, the first trust value of each detection node is determined by the detection result of each detection node in each node cluster detecting the target domain name, and then the second trust value of each node cluster is determined according to the first trust value of each detection node in each node cluster. Since each detection node in the target node cluster has obtained the first trust value of each detection node by detecting the target domain name, the credibility of the second trust value of each node cluster determined by the first trust value is relatively high, and at least one trusted target node cluster can be determined according to the second trust value. The network risk detection of the domain name to be detected is implemented through the detection nodes in the target node cluster to obtain the network risk detection result. Compared with the related art of directly trusting any detection nodes in the distributed detection nodes to realize network risk detection of the domain name, in the present application, the detection nodes of the trusted node cluster are selected to perform network risk detection on the domain name to be detected, so as to improve the accuracy of network risk detection of the domain name to be detected through multiple detection nodes.

[0053] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0055] Figure 1 It is a schematic diagram of the system framework corresponding to the domain name risk detection method provided in the embodiment of the present application;

[0056] Figure 2 It is a scenario diagram of the domain name risk detection method provided in an embodiment of the present application;

[0057] Figure 3 It is a flowchart of a domain name risk detection method provided in an embodiment of the present application;

[0058] Figure 4 is a schematic diagram of a process for determining a first trust value of each detection node provided in an embodiment of the present application;

[0059] Figure 5 is another flow chart of the domain name risk detection method provided in an embodiment of the present application;

[0060] Figure 6 It is a structural diagram of a domain name risk detection device provided in an embodiment of the present application;

[0061] Figure 7 It is a schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0062] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0063] It should be noted that in the specific implementation of this application, domain names and other related data are involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards.

[0064] The embodiments of the present application provide a domain name risk detection method, device, computer equipment and storage medium. Specifically, the embodiments of the present application will be described from the dimension of the domain name risk detection device, which can be integrated in a computer device, which can be a server or a terminal. Among them, the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. Among them, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc., but is not limited to this.

[0065] Before further describing the embodiments of the present disclosure in detail, the nouns and terms involved in the embodiments of the present disclosure are described. The nouns and terms involved in the embodiments of the present disclosure are subject to the following interpretations:

[0066] Domain name: A domain name is a character-based identifier used to identify and locate network resources such as websites on the Internet. It consists of several parts, usually including a top-level domain name (such as .com, .net, .org, .cn, etc.), a second-level domain name, and possible subdomains at more levels. For example, in "www.example.com", "example" is the second-level domain name, ".com" is the top-level domain name, and "www" is usually the host name.

[0067] Root resolution: Root resolution of a domain name refers to the resolution process of a top-level domain name (TLD). The Internet's Domain Name System (DNS) is a hierarchical naming system. At the top of this system is the root domain name server, which is responsible for managing top-level domain names. When performing domain name resolution, the resolution process starts with the domain name to be resolved and gradually traces back to the root domain name server to determine the IP address or other resource information corresponding to the domain name. For example, when a user enters "www.example.com" in a browser, it will first initiate a query request to the local DNS server. If the local DNS server does not have a cache record of the domain name, it will query the upper-level DNS server and may eventually reach the root domain name server to determine the authoritative server address of the ".com" top-level domain name, and then obtain the specific resolution information of "example.com" from the authoritative server, and finally determine the IP address corresponding to "www.example.com". Root resolution is crucial to the normal operation of the entire Internet. It ensures that the domain name can be correctly resolved to the corresponding network resource address.

[0068] First, let’s describe the technical problems existing in the relevant technologies:

[0069] With the development of Internet technology, each website has a corresponding domain name. In the Internet, the domain name system is used to convert human-readable domain names into computer-understandable IP addresses. This process involves resolving from the top-level domain name step by step downwards, and finally finding the IP address of the corresponding website server. If the domain name resolution service in some areas is stopped, interrupted, deleted, tampered with, etc., the website of the corresponding domain name will be inaccessible, or the website of the corresponding domain name will be hijacked, which will make it impossible to correctly access the website of the corresponding domain name.

[0070] In the related art, a large number of distributed detection nodes are deployed in different regions, and domain name resolution is achieved through a large number of distributed detection nodes. Whether the website of the corresponding domain name is safe to access is determined based on the resolution result of any detection node. However, there are a large number of distributed detection nodes, and the geographical locations of the detection nodes are relatively scattered. Due to network factors, basic resource failures or network attacks, some detection nodes fail to detect network risks for some domain names or the network risk detection results are inaccurate.

[0071] In order to solve the above problems, the embodiment of the present application determines the first trust value of each detection node through the detection result of each detection node in each node cluster detecting the target domain name, and then determines the second trust value of each node cluster according to the first trust value of each detection node in each node cluster. Since each detection node in the target node cluster has obtained the first trust value of each detection node by detecting the target domain name, the credibility of the second trust value of each node cluster determined by the first trust value is relatively high, and at least one trusted target node cluster can be determined according to the second trust value. The network risk detection of the domain name to be detected is implemented through the detection nodes in the target node cluster to obtain the network risk detection result. Compared with the related art of directly trusting any detection nodes in the distributed detection nodes to realize network risk detection of the domain name, the present application selects the detection nodes of the trusted node cluster to perform network risk detection on the domain name to be detected, which can improve the accuracy of network risk detection of the domain name to be detected through multiple detection nodes.

[0072] The domain name risk detection method, apparatus, computer equipment and storage medium provided in the embodiments of the present application are described in detail below.

[0073] See also Figure 1 , Figure 1 1 is a schematic diagram of a system framework corresponding to the domain name risk detection method provided in the embodiment of the present application. The domain name risk detection method provided in the embodiment of the present application can be applied to the system framework.

[0074] Please refer to Figure 1 , Figure 1 1 is a system architecture diagram of the domain name risk detection method provided in the embodiment of the present application, which includes a terminal 140, the Internet 130, a gateway 120, a server 110, and the like.

[0075] The terminal 140 or the server 110 may be a device for executing the domain name risk detection method.

[0076] The terminal 140 includes but is not limited to mobile phones, computers, intelligent voice interaction devices, smart home appliances, vehicle-mounted terminals, aircraft, etc. The embodiments of the present application can be applied to various scenarios, including but not limited to cloud office, enterprise management, etc. In addition, it can be a single device or a collection of multiple devices. For example, multiple desktop computers are interconnected through a local area network, share a display, etc. to work together, and together constitute a terminal 140. The terminal 140 can communicate with the Internet 130 in a wired or wireless manner to exchange data.

[0077] The server 110 refers to a computer system that can provide certain services to the terminal 140. Compared with the ordinary terminal 140, the server 110 has higher requirements in terms of stability, security, performance, etc. The server 110 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms.

[0078] The gateway 120 is also called an internetwork connector or a protocol converter. The gateway realizes network interconnection at the transport layer and is a computer system or device that acts as a converter. The gateway is a translator between two systems that use different communication protocols, data formats or languages, or even completely different architectures. At the same time, the gateway can also provide filtering and security functions. The message sent by the terminal 140 to the server 110 must be sent to the corresponding server 110 through the gateway 120. The message sent by the server 110 to the terminal 140 must also be sent to the corresponding terminal 140 through the gateway 120.

[0079] The domain name risk detection method in the embodiment of the present application can be applied to the network risk detection scenario of the domain name.

[0080] See also Figure 2 , Figure 2 It is a scenario diagram of the domain name risk detection method provided in an embodiment of the present application.

[0081] Among them, there are cloud servers or lightweight application servers scattered in different geographical areas on the Internet. These devices can be used as distributed detection nodes to simulate DNS recursive query behavior, query and collect data from many root servers and top-level domain authoritative servers, so as to realize network detection of domain names and obtain detection results.

[0082] The number of detection nodes is distributed in different regions. For some domain name detection, the detection results of detection nodes in different regions for these domain names will be different. Therefore, the geographical location information of each detection node can be obtained, and then multiple detection nodes can be divided into multiple node clusters according to the geographical location information of each detection node. For example, some detection nodes with relatively close geographical location information can be divided into one node cluster, and multiple node clusters can be divided in this way.

[0083] In each node cluster, a target detection node can be determined. The target detection node is used to monitor other detection nodes in each node cluster. For example, the target detection node can monitor the survival status of other detection nodes in the same node cluster and the detection results of other detection nodes on some domain names. The target detection node will also periodically send heartbeat information to other detection nodes in the same node cluster to inform the survival status of the target detection node.

[0084] In each node cluster, other detection nodes except the target detection node can send the survival status information of the node to the target detection node, and can also send the detection results of the domain name to the target detection node. It should be noted that in a node cluster, the target detection node is used to detect the survival status and detection results of other detection nodes in the same cluster, and send relevant instructions to other detection nodes to guide other detection nodes to perform corresponding tasks. Other detection nodes other than the target detection node in the same cluster are mainly used for network risk detection of domain names.

[0085] The network risk analysis center is used to obtain relevant information in different node clusters, such as the detection results of the detection node on the domain name, the survival status of the detection node, etc. The network risk analysis center can also be used to obtain the detection results of each detection node on the target domain name in each node cluster, and determine the first trust value corresponding to each detection node according to the detection results, and determine the second trust value of each node cluster according to the first trust value corresponding to each detection node in each node cluster, so as to select at least one target node cluster that can be trusted from multiple node clusters according to the second trust value, and perform network risk detection on the domain name to be detected according to the detection nodes in at least one target node cluster to obtain the network risk detection result.

[0086] The network risk analysis center can issue query instructions to multiple detection nodes in each node cluster, such as sending query instructions to the target detection node, which then sends query instructions to other detection nodes in the same cluster. Other detection nodes can detect the domain name to be detected according to the query instructions to obtain detection results. The network risk analysis center can obtain the detection results of the detection nodes in the target node cluster that are used to detect the domain name to be detected, and finally determine the network risk detection results of the domain name to be detected based on the detection results of multiple detection nodes.

[0087] It can be seen from the above content that in an embodiment of the present application, the first trust value of each detection node can be determined through the detection result of the target domain name by each detection node in each node cluster. Since the first trust value is determined by the detection result of the real detection of the target domain name, the first trust value is accurate. Then, the second trust value of each node cluster is determined according to the first trust value corresponding to each detection node in each node cluster. Finally, at least one target node cluster that can be trusted can be determined from multiple node clusters through the second trust value. Network risk detection is performed on the domain name to be detected according to the detection nodes in at least one target node cluster to obtain a network risk detection result. Compared with the related art of directly trusting any detection nodes in the distributed detection nodes to realize network risk detection of the domain name, in the present application, the detection nodes of the trusted node cluster are selected to perform network risk detection on the domain name to be detected, so as to improve the accuracy of network risk detection of the domain name to be detected through multiple detection nodes.

[0088] See also Figure 3 , Figure 3 : is a flowchart of a domain name risk detection method provided in an embodiment of the present application. The domain name risk detection method may include the following steps:

[0089] Step 210: determining a plurality of detection nodes, and dividing the plurality of detection nodes into a plurality of node clusters according to the geographical location information of each detection node;

[0090] Step 220: obtaining a detection result of each detection node detecting the target domain name in each node cluster, and determining a first trust value corresponding to each detection node according to the detection result;

[0091] Step 230: determining a second trust value for each node cluster according to the first trust value corresponding to each detection node in each node cluster;

[0092] Step 240: selecting at least one target node cluster that can be trusted from multiple node clusters according to the second trust value;

[0093] Step 250: Perform network risk detection on the domain name to be detected according to the detection nodes in at least one target node cluster to obtain a network risk detection result.

[0094] Steps 210 to 250 will be described in detail below.

[0095] In step 210, a plurality of detection nodes are determined, and the plurality of detection nodes are divided into a plurality of node clusters according to the geographical location information of each detection node.

[0096] The number of detection nodes is distributed in different regions. For some domain name detection, the detection results of detection nodes in different regions for these domain names will be different. Therefore, the geographical location information of each detection node can be obtained, and then multiple detection nodes can be divided into multiple node clusters according to the geographical location information of each detection node. For example, some detection nodes with relatively close geographical location information can be divided into one node cluster, and multiple node clusters can be divided in this way.

[0097] In some implementations, multiple detection nodes are divided according to the geographic location information of each detection node to obtain multiple node clusters, including:

[0098] (1.1) Clustering multiple detection nodes according to the geographic location information of each detection node to obtain multiple geographic location categories;

[0099] (1.2) Multiple detection nodes corresponding to each geographic location category are determined as a node cluster to obtain multiple node clusters.

[0100] Among them, the geographical location information of multiple detection nodes will be different. Several target geographical locations can be determined in advance. For example, a target geographical location can be determined in Beijing, New York, Tokyo, London and other regions respectively. Then, multiple detection nodes are clustered according to these target geographical locations and the geographical location information of each detection node, so as to obtain multiple geographical location categories.

[0101] For example, the target geographic location is taken as the initial category center, and the geographic location information of each detection node can be regarded as the point to be clustered. Then, different points are clustered according to the category center to determine multiple geographic location categories. There are multiple points in each geographic location category, that is, there are multiple detection nodes in each geographic location category.

[0102] Finally, multiple detection nodes corresponding to each geographic location category are determined as a node cluster, and multiple node clusters are obtained.

[0103] The advantage of doing this is that detection nodes with close geographical locations can be grouped together. When detection nodes within a node cluster conduct network risk detection on domain names in a certain area, the detection speed is faster and more accurate.

[0104] In step 220, the detection result of each detection node detecting the target domain name is obtained in each node cluster, and the first trust value corresponding to each detection node is determined according to the detection result.

[0105] In this application, a detection task can be issued to each detection node in each node cluster, such as detecting the target domain name, so as to obtain the detection result. The detection task can be issued multiple times, and after each detection task is issued, the corresponding target domain name can be detected, so as to obtain the corresponding detection result. The target domain name can be one, two, or even multiple domain names, which is not limited here.

[0106] In this way, the detection nodes in each node cluster can realize the real detection of the target domain name, and the first trust value corresponding to each detection node can be determined through the detection result. The first trust value can be understood as the credibility score of each detection node, which can reflect the accuracy of the detection result of each detection node. The first trust value is determined based on the real detection result of the detection node, so the first trust value is credible.

[0107] In some implementations, obtaining the detection result of each detection node detecting the target domain name in each node cluster includes:

[0108] (1.1) Determine the corresponding target detection node in each node cluster. The target detection node is used to monitor other detection nodes in each node cluster.

[0109] (1.2) In each node cluster, the detection results of each detection node except the target detection node on the target domain name are obtained according to the target detection node.

[0110] In each node cluster, the target detection node is used to detect the survival status and detection results of other detection nodes in the same cluster, and send relevant instructions to other detection nodes to guide other detection nodes to perform corresponding tasks. Other detection nodes other than the target detection node in the same cluster are mainly used to detect network risks of domain names.

[0111] In each node cluster, the detection results of each detection node except the target detection node for the target domain name are obtained according to the target detection node. For example, the detection task instruction can be conveyed to the target detection node in each node cluster, and then the target detection node sends the detection task instruction to other detection nodes in the same cluster. After executing the detection task instruction, other detection nodes will send the detection results to the target detection node. The target detection node can store the detection results of each detection node. Finally, the detection results corresponding to each detection node are obtained from the target detection node.

[0112] In some implementations, determining a corresponding target detection node in each node cluster includes:

[0113] (1.1.1) In each node cluster, obtain the number of votes of each candidate detection node of the election target detection node, and the number of votes is determined based on the voting information of other detection nodes other than each candidate detection node;

[0114] (1.1.2) The candidate detection node with the largest number of votes is determined as the target detection node.

[0115] Among them, when there is no target detection node in each node cluster, any detection node in each node cluster can be elected as the target detection node, and the detection nodes that are elected as the target detection node are candidate detection nodes. Each candidate detection node can send election information to other detection nodes in the same cluster, and then other detection nodes can generate voting information based on the election information of each candidate detection node, and the number of votes for each candidate detection node can be determined based on the voting information. Finally, the candidate detection node with the largest number of votes is determined as the target detection node.

[0116] For example, taking a node cluster as an example, when there is no target detection node in the node cluster, the election of the target detection node is triggered, and any detection node can participate in the election. Taking detection node A in the node cluster as an example, detection node A sends an election message to other detection nodes in the node cluster, such as detection node B, detection node C, etc. After receiving the election message, other detection nodes can determine the election time of each candidate detection node according to the election message, and then vote for the candidate detection node with the earliest election time, vote against other candidate detection nodes, or do not vote for other candidate detection nodes. If a detection node in the node cluster receives the election message, the detection node will not participate in the election of the target detection node.

[0117] Finally, the number of votes in favor of each candidate detection node can be obtained, and finally the candidate detection node with the largest number of votes is determined as the target detection node.

[0118] After determining the target detection node, the target detection node periodically sends heartbeat messages to other detection nodes in the node cluster to inform other detection nodes in the node cluster of its own survival status to maintain the status of the target detection node.

[0119] A timer can also be set for each detection node in the node cluster. When the timer is triggered and the trigger time exceeds the preset trigger duration, the election of the target detection node in the node cluster is triggered. If other detection nodes in the node cluster receive the heartbeat message of the target detection node within the preset trigger duration, the timer is reset to reset the trigger duration and avoid the election of a new target detection node in the node cluster. If the duration for other detection nodes in the node cluster to receive the heartbeat message of the target detection node exceeds the preset trigger duration, the election of a new target detection node in the node cluster is triggered.

[0120] From the above content, it can be seen that the most stable target detection node can be continuously determined in the node cluster, and the target detection node can stably interact with the network risk analysis center, thereby ensuring the accuracy of the detection of network risks of domain names.

[0121] See also Figure 4 , Figure 4 It is a schematic diagram of a process for determining a first trust value of each detection node provided in an embodiment of the present application.

[0122] In some implementations, determining the first trust value corresponding to each detection node according to the detection result may include the following steps:

[0123] Step 301: Obtain the response rate of each detection node in detecting the target domain name;

[0124] Step 302: determine the consistency rate between the detection result of each detection node and the detection results of other detection nodes;

[0125] Step 303: Obtain the response speed of each detection node in detecting the target domain name;

[0126] Step 304: Determine a first trust value corresponding to each detection node according to the response speed, response rate and result consistency rate corresponding to each detection node.

[0127] Steps 301 to 304 will be described in detail below.

[0128] In step 301, the response rate of each detection node in detecting the target domain name is obtained.

[0129] The response rate of each detection node for detecting the target domain name can be understood as the probability that each detection node responds to the detection task after the detection task for the target domain name is issued to each detection node.

[0130] For example, within each node cluster, a detection task can be issued to each detection node used for domain name detection, and the number of times the detection task is issued can be determined as a preset detection number, and then the detection result returned by each detection node used for domain name detection is received, and the number of times the detection result returned by each detection node is received is determined as the actual detection number of each detection node, and finally, based on the preset detection number and the actual detection number of the detection result returned by each detection node, the response rate of each detection node to the target domain name detection is determined.

[0131] In some implementations, obtaining a response rate of each detection node for detecting a target domain name includes:

[0132] (1.1) In each node cluster, determine the preset number of detections that each detection node performs on the target domain name within a preset time range;

[0133] (1.2) Obtain the actual number of detections of the target domain name by each detection node within the preset time range;

[0134] (1.3) Divide the actual number of detections of each detection node by the preset number of detections to obtain the detection response rate corresponding to each detection node.

[0135] Among them, the preview time range before the current time can be determined, and then in each node cluster, the number of detection tasks sent to each detection node is determined within the preset time range. For example, if there are 10 times, the preset detection number is determined to be 50.

[0136] Then determine the actual number of detections performed by each detection node on the target domain name within a preset time range. For example, in a node cluster, detection node A returns detection results 5 times, and detection node B returns detection results 10 times. Then the actual number of detections performed by detection node A is 5 times, and the actual number of detections performed by detection node B is 10 times.

[0137] Finally, the actual detection times of each detection node are divided by the preset detection times to get the response rate of each detection node. Assuming the preset detection times are 50 times and the actual detection times of detection node B are 10 times, the response rate is 20%. The specific calculation formula is: .in, The corresponding response rate for each detection node. is the actual number of detections, N is the preset number of detections, and i is the node i.

[0138] From the above, it can be seen that by determining the response rate corresponding to each detection node in each node cluster, the response rate can reflect the response of each detection node in the process of detecting the target domain name, and can reflect the activity of each detection node in responding to the detection task.

[0139] In step 302, the result consistency rate between the detection result of each detection node and the detection results of other detection nodes is determined.

[0140] It can be understood that in a detection task, for example, each detection node in a node cluster detects the target domain name to obtain a detection result. The first number of all detection results collected in the detection task can be obtained, and then the second number of detection nodes whose detection results are the same as the detection results of a certain detection node can be determined, and then the proportion of the second number in the first number can be determined. In this way, the consistency rate between the detection results of the detection node and the detection results of other detection nodes in the detection task can be determined.

[0141] In some implementations, determining the result consistency rate between the detection result of each detection node and the detection results of other detection nodes includes:

[0142] (1.1) in each node cluster, determining a first number of detection nodes that respond each time a target domain name is detected within a preset time range;

[0143] (1.2) determining a second number of detection nodes having detection results that are the same as the detection result of each detection node;

[0144] (1.3) Dividing the second number by the first number, to obtain the sub-result consistency rate corresponding to each detection node when the target domain name is detected each time within a preset time range;

[0145] (1.4) Each time the target domain name is detected, the sub-result consistency rates corresponding to each detection node are added together and divided by the preset number of detections to obtain the result consistency rate between the detection result of each detection node and the detection results of other detection nodes.

[0146] Among them, in each node cluster, the first number of detection nodes that respond each time the target domain name is detected within a preset time range is determined. For example, in a node cluster, in a detection task, a total of 100 detection nodes return the detection results, then 100 detection nodes respond, and the first number is 100.

[0147] Then, the second number of detection nodes having the same detection result as the detection result of each detection node is determined. For example, in a certain detection task, the number of other detection nodes in the node cluster having the same detection result as the detection result of detection node A is 50, then the second number is 50.

[0148] Then divide the second number by the first number to get the sub-result consistency rate corresponding to each detection node when the target domain name is detected each time within the preset time range. For example, in this detection task, divide 50 by 100, then the sub-result consistency rate of the detection result in the node cluster that is the same as the detection result of detection node A is 50%. The specific calculation formula is:

[0149] , ,in, is the sub-result consistency rate, is the second quantity, is the first quantity, In a certain detection task, N is the preset number of detections.

[0150] Finally, the sub-result consistency rate corresponding to each detection node each time the target domain name is detected can be added and divided by the preset number of detections to obtain the result consistency rate between the detection result of each detection node and the detection results of other detection nodes. For example, if the preset number of detections is 3 times, and the sub-result consistency rates of detection node A under different detection tasks are 50%, 60%, and 10%, respectively, then the result consistency rate between the detection result of each detection node and the detection results of other detection nodes is 40%. The specific calculation formula is:

[0151] ,in, The result consistency rate is the result consistency rate. The result consistency rate of each detection node is determined by obtaining the sub-result consistency rates under different detection tasks and calculating the average. The result consistency rate calculated in this way can eliminate most errors, thereby improving the accuracy of the result consistency rate.

[0152] As can be seen from the above content, in the present application, by determining the result consistency rate between the detection result of each detection node and the detection results of other detection nodes, the accuracy of the detection result of each detection node can be reflected, which is conducive to the subsequent accurate determination of the first trust value of each detection node.

[0153] In step 303, the response speed of each detection node in detecting the target domain name is obtained.

[0154] It can be understood that the response speed of each detection node to detect the target domain name is related to the response delay of each node. The response delay can be understood as the time delay between sending a detection task to each detection node and receiving the detection result. Generally, the lower the response delay of the detection node, the faster the response speed of the detection node. The response speed can be understood as the speed between sending a detection task to each detection node and receiving the detection result. Therefore, the response speed of each detection node to detect the target domain name can be determined by the response delay of each detection node.

[0155] In some implementations, obtaining the response speed of each detection node in detecting the target domain name includes:

[0156] (1.1) Each time the target domain name is detected, the response delay of each detection node in multiple node clusters is obtained, and the maximum response delay is determined;

[0157] (1.2) Subtract the response delay of each detection node from the maximum response delay and divide it by the maximum response delay to obtain the relative response delay of each detection node.

[0158] (1.3) Multiply the relative response delay corresponding to each detection node by the preset adjustment coefficient to obtain the response speed of each detection node for detecting the target domain name.

[0159] Among them, the detection nodes of multiple node clusters can perform a same detection task, that is, detect the target domain name, and obtain the response delay of each detection node in the multiple node clusters in this detection task, and then determine the maximum response delay.

[0160] Then, the maximum response delay minus the response delay of each detection node is divided by the maximum response delay to obtain the relative response delay corresponding to each detection node. In this way, the relative response delay of each detection node is determined under a measurement standard, which is the maximum response delay in this detection task. The specific calculation formula is:

[0161] ,in, is the relative response delay, is the maximum response delay, i is a detection node, is the response delay of detection node i, and t is the tth detection task.

[0162] Finally, the relative response delay corresponding to each detection node is multiplied by the preset adjustment coefficient to obtain the response speed of each detection node for detecting the target domain name. The specific calculation formula is:

[0163] ,in, is the response speed of the detection node i, is the preset adjustment factor.

[0164] From the above content, it can be seen that selecting the maximum response delay from multiple node clusters and using it as a measurement standard can more accurately determine the relative response delay between different detection nodes, thereby more accurately determining the response speed of each detection node.

[0165] In step 304, a first trust value corresponding to each detection node is determined according to the response speed, response rate and result consistency rate corresponding to each detection node.

[0166] It can be understood that the response rate can reflect the stability of each detection node, the result consistency rate can reflect the detection accuracy of each detection node, and the response speed can reflect the node performance of each detection node. Therefore, the first trust value corresponding to each detection node is determined by the response speed, response rate and result consistency rate corresponding to each detection node. The first trust value can reflect the reliability of each detection node in performing domain name detection as a whole.

[0167] In some implementations, determining a first trust value corresponding to each detection node according to a response speed, a response rate, and a result consistency rate corresponding to each detection node includes:

[0168] (1.1) According to the response rate and result consistency rate corresponding to each detection node, determine the target response rate corresponding to each detection node;

[0169] (1.2) determining a first weight corresponding to the target response rate and a second weight corresponding to the response speed;

[0170] (1.3) Multiplying the target response rate by the first weight to obtain a first result, and multiplying the second weight by the response speed to obtain a second result;

[0171] (1.4) Add the first result and the second result to obtain the first trust value corresponding to each detection node.

[0172] Among them, the target response rate corresponding to each detection node can be determined according to the response rate and result consistency rate corresponding to each detection node. For example, a first coefficient is set for the result consistency rate corresponding to each detection node, and a second coefficient is set for the response rate corresponding to each detection node. The first coefficient is multiplied by the result consistency rate corresponding to each detection node to obtain a first product, and the second coefficient is multiplied by the response rate corresponding to each detection node to obtain a second product. Finally, the first product and the second product are added together to obtain the target response rate corresponding to each detection node. The specific calculation formula is as follows:

[0173] , .in, is the target response rate, is the first coefficient, is the second coefficient, is the result consistency rate, is the response rate, and i is a detection node i.

[0174] After determining the target response rate corresponding to each detection node, determine the first weight corresponding to the target response rate and the second weight corresponding to the response speed. Then multiply the target response rate by the first weight to obtain the first result, multiply the second weight by the response speed to obtain the second result, add the first result and the second result together to obtain the first trust value corresponding to each detection node. The specific calculation formula is as follows:

[0175] , ,in is the first trust value, is the first weight, is the second weight, is the target response rate, For response speed.

[0176] It can be seen from the contents of step 301 to step 304 that the response speed, response rate and result consistency rate of each detection node in each node cluster are first accurately determined, and the first trust value corresponding to each detection node is determined through the response speed, response rate and result consistency rate corresponding to each detection node. The first trust value can reflect the reliability of each detection node in performing domain name detection as a whole.

[0177] In step 230, a second trust value of each node cluster is determined according to the first trust value corresponding to each detection node in each node cluster.

[0178] Among them, the first trust value corresponding to each detection node in each node cluster can reflect the accuracy of each detection node when detecting the domain name. Then, the second trust value of each node cluster can be determined by the first trust value corresponding to each detection node in each node cluster, and the second trust value can reflect the accuracy of each node cluster when detecting the domain name.

[0179] In some implementations, determining the second trust value of each node cluster according to the first trust value corresponding to each detection node in each node cluster includes:

[0180] (1.1) Determine multiple detection time points, and obtain the first trust value corresponding to each detection node in each node cluster at each detection time point;

[0181] (1.2) multiplying the first trust value corresponding to each detection node in each node cluster at each detection time point by the corresponding preset weight coefficient and then adding them together to obtain the target first trust value corresponding to each detection node in each node cluster;

[0182] (1.3) The target first trust value corresponding to each detection node in each node cluster is added and divided by the total number of detection nodes used for domain name detection in each node cluster to obtain the second trust value of each node cluster.

[0183] Among them, multiple detection time points can be determined, each detection time point corresponds to a detection task for the target domain name, and the first trust value corresponding to each detection node in each node cluster at each detection time point is obtained. Then, according to the first trust value corresponding to each detection node in each node cluster at multiple detection time points, the first trust value corresponding to each detection node in each node cluster at each detection time point is multiplied by the corresponding preset weight coefficient and then added to obtain the target first trust value corresponding to each detection node in each node cluster. The specific calculation formula is as follows:

[0184] ( ).in, is the first trust value of the target, t is the detection time point, and t can also be understood as the detection task of each detection of the target domain name. is the preset weight coefficient.

[0185] It should be noted that the target first trust value corresponding to each detection node determined by the first trust values ​​at different detection time points can reduce the error of the first trust value, thereby obtaining a target first trust value with higher reliability.

[0186] Finally, the target first trust value corresponding to each detection node in each node cluster is added and divided by the total number of detection nodes used for domain name detection in each node cluster to obtain the second trust value of each node cluster. The specific calculation formula is as follows:

[0187] . Wherein, C is the second trust value, and M is the total number of detection nodes in each node cluster that do not include the target detection node, that is, the total number of detection nodes used for domain name detection in each node cluster.

[0188] The advantage of doing so is that within each node cluster, the second trust value of each node cluster can be determined more accurately through the target first trust values ​​of multiple detection nodes, thereby improving the reliability of the second trust value.

[0189] In step 240, at least one trustworthy target node cluster is selected from a plurality of node clusters according to the second trust value.

[0190] For example, according to the value of the second trust value, a node cluster whose second trust value is greater than a preset trust value may be selected from multiple node clusters as the target node cluster.

[0191] In some implementations, selecting at least one trustworthy target node cluster from multiple node clusters according to the second trust value includes:

[0192] (1.1) Sort multiple node clusters from high to low according to the second trust value to obtain a sorting result;

[0193] (1.2) Select at least one target node cluster with a higher ranking from the multiple node clusters according to the sorting result.

[0194] Among them, the multiple node clusters can be sorted from high to low according to the second trust value to obtain a sorting result, and then at least one target node cluster with a top ranking is selected from the multiple node clusters according to the sorting result, for example, the first five node clusters are selected as the target node clusters.

[0195] The target node cluster is the node cluster that will subsequently perform network risk detection on the domain name to be detected.

[0196] In step 250, network risk detection is performed on the domain name to be detected according to the detection nodes in at least one target node cluster to obtain a network risk detection result.

[0197] Since the second trust value of the target node cluster is higher, it is considered that the detection node in the target node cluster performs network risk detection on the domain name to be detected, and the accuracy of the network risk detection result is higher.

[0198] In some implementations, performing network risk detection on a domain name to be detected according to a detection node in at least one target node cluster to obtain a network risk detection result includes:

[0199] (1.1) inputting a query instruction to each detection node used for domain name detection in at least one target node cluster;

[0200] (1.2) Obtain the detection result of each detection node used for domain name detection after detecting the domain name to be detected according to the query instruction;

[0201] (1.3) Determine the network risk detection result of the domain name to be detected based on the detection results of multiple detection nodes used for domain name detection.

[0202] It should be noted that when there are risks in domain name ownership, it affects the security and stability of the Internet. These risks can be summarized into three categories:

[0203] 1) Risk of service suspension and network disconnection: Once the resolution service is suspended in a certain area or the network is disconnected, the resolution cycle will be interrupted, resulting in network interruption.

[0204] 2) Risk of top-level domain being deleted / tampered: Once the top-level domain data of a certain region is deleted / tampered with from the root zone, the network services under the top-level domain will disappear and cannot be discovered and accessed globally.

[0205] 3) Risk of deletion / tampering of important domain names: If the data of important domain names registered overseas in a certain region is tampered with, the corresponding website will be hijacked to other websites. Therefore, different regions need to have the risk detection capability of domain name resource ownership to timely discover perceived risks on the Internet.

[0206] For the first type of risk detection, you can select the target node cluster of the region in the target node cluster according to the region corresponding to the domain name to be detected, and then enter the query command to perform a detection query on the detection node of the target node cluster in the region. For example, enter the dig command to perform a detection query to the global root server or the top-level domain authoritative server (such as dig @{global root server IP} . soa and dig @{.cn top-level domain authoritative server IP} cn soa), and check the resolution status Status field and ANSWER field in the detection result returned by the analysis. If the resolution status Status field in the detection result returned by the detection node is NOERROR and the ANSWER field is not empty, the detection node believes that the domain name service status is normal, otherwise it is considered that the domain name is at risk of being suspended and disconnected from the network. The domain name to be detected can be the top-level domain name of the region.

[0207] The Network Risk Analysis Center believes that the risk of service outage in the specified area has occurred. The specific strategy for determining the risk of service outage is as follows: If more than 80% (the proportion can be adjusted by the administrator) of the detection nodes in the node cluster located in the specified area believe that the domain name is at risk of service outage, and at the same time, the detection nodes of the other N target node clusters with the highest first trust values ​​believe that the domain name service status is normal, the Network Risk Analysis Center will ultimately determine that the risk of service outage has occurred in the specified area and output an alarm message.

[0208] For the second type of risk detection, the Network Risk Analysis Center excludes the node clusters located in the region corresponding to the domain name to be detected and selects the first N node clusters with higher trust values ​​from the remaining node clusters (the number N can be configured by the administrator), that is, a total of N target node clusters are used. All detection nodes in these target node clusters will perform the detection task. Among them, the domain name to be detected can be a top-level domain name.

[0209] Query instructions can be input to these detection nodes. For example, for each detection node, the dig command is used to poll the global root server that can be connected to query the NS record of the top-level domain name of the specified region (such as dig @{global root server IP} cnns), and the resolution status Status field and AUTHORITY field in the returned detection results are analyzed. The detection node will record the AUTHORITY field of the first detection result as the benchmark data, and the updated benchmark data can be uniformly issued to each detection node through the network risk analysis center later. If the AUTHORITY field in the detection results returned by the detection node is empty, or the resolution status Status field returns the NXDOMAIN error code or other resolution error code, the detection node believes that the top-level domain name in the specified region has a risk of being deleted. If the resolution status Status field in the detection result returned by the detection node is NOERROR and the AUTHORITY field is not empty, the AUTHORITY field of the next five consecutive periodic detection results will be compared with the benchmark data. If they are completely consistent, the detection node believes that the top-level domain name in the specified region has no risk of being deleted / tampered. If there is inconsistency, the detection node believes that the top-level domain name in the specified region has a risk of being tampered.

[0210] The Network Risk Analysis Center believes that the top-level domain name in the specified area has been deleted / tampered with. Risk judgment strategy: If the detection nodes of N node clusters with the highest second trust values ​​all believe that the top-level domain name in the specified area has been deleted / tampered with, the Network Risk Analysis Center will ultimately determine that the specified area has been deleted / tampered with and output an alarm message.

[0211] For the third type of risk detection, the Network Risk Analysis Center selects the first N node clusters with higher second trust values ​​(the number N can be configured by the administrator) based on the second trust value ranking results of node clusters worldwide, and uses a total of N node clusters. All detection nodes in these node clusters will perform detection tasks.

[0212] For each distributed detection node, you can enter the corresponding query command. For example, enter the dig command to poll the top-level domain name authoritative server corresponding to these second-level domain names to query the NS record of the second-level domain name to be detected (such as dig @{.com top-level domain name authoritative server IP} xxxx.com ns), and analyze the resolution status Status field and AUTHORITY field in the returned detection results. The distributed detection node will record the AUTHORITY field of the first detection result as the benchmark data, and the updated benchmark data can be uniformly issued to each detection node through the network risk analysis center later. If the AUTHORITY field in the detection result returned by the detection node is empty, or the resolution status Status field returns other resolution error codes such as NXDOMAIN, the detection node believes that the detected second-level domain name has a risk of important domain name deletion. If the resolution status field of the detection result returned by the detection node is NOERROR and the AUTHORITY field is not empty, the AUTHORITY field of the next five consecutive periodic detection results will be compared with the benchmark data. If they are completely consistent, the detection node believes that there is no risk of important domain name deletion / tampering in the detected second-level domain name. If there is inconsistency, the detection node believes that there is a risk of important domain name tampering in the detected second-level domain name. The domain name to be detected can be a second-level domain name.

[0213] The Network Risk Analysis Center believes that the detected second-level domain name has been deleted / tampered with as an important domain name. Risk judgment strategy: If the detection nodes of the N node clusters with the highest second trust values ​​all believe that the detected second-level domain name has been deleted / tampered with as an important domain name, the Network Risk Analysis Center will ultimately determine that the detected second-level domain name has been deleted / tampered with as an important domain name and output an alarm message.

[0214] From the above content, it can be seen that in the present application, by accurately determining the second trust value of each node cluster, at least one target node cluster that can be trusted can be found according to the second trust value, thereby realizing network risk detection of the domain name to be detected through at least one target node cluster that can be trusted, and obtaining a network risk detection result. The accuracy of network risk detection of the domain name to be detected through multiple detection nodes is improved.

[0215] In an embodiment of the present application, multiple detection nodes are determined, and multiple node clusters are obtained by dividing the multiple detection nodes according to the geographical location information of each detection node; the detection result of each detection node on the target domain name is obtained in each node cluster, and a first trust value corresponding to each detection node is determined according to the detection result; a second trust value of each node cluster is determined according to the first trust value corresponding to each detection node in each node cluster; at least one target node cluster that can be trusted is selected from the multiple node clusters according to the second trust value; network risk detection is performed on the domain name to be detected according to the detection nodes in at least one target node cluster, and a network risk detection result is obtained. In this way, the first trust value of each detection node is determined by the detection result of each detection node in each node cluster detecting the target domain name, and then the second trust value of each node cluster is determined according to the first trust value of each detection node in each node cluster. Since each detection node in the target node cluster has obtained the first trust value of each detection node by detecting the target domain name, the credibility of the second trust value of each node cluster determined by the first trust value is relatively high, and at least one trusted target node cluster can be determined according to the second trust value. The network risk detection of the domain name to be detected is implemented through the detection nodes in the target node cluster to obtain the network risk detection result. Compared with the related art of directly trusting any detection nodes in the distributed detection nodes to realize network risk detection of the domain name, in the present application, the detection nodes of the trusted node cluster are selected to perform network risk detection on the domain name to be detected, so as to improve the accuracy of network risk detection of the domain name to be detected through multiple detection nodes.

[0216] See also Figure 5 , Figure 5 1 is another flow chart of the domain name risk detection method provided in the embodiment of the present application. The domain name risk detection method may include the following steps:

[0217] Step 401: determine a plurality of detection nodes, and divide the plurality of detection nodes into a plurality of node clusters according to the geographical location information of each detection node;

[0218] Step 402: Obtain detection results of each detection node on the target domain name in each node cluster, and obtain a response rate of each detection node on the target domain name;

[0219] Step 403: determine the consistency rate between the detection result of each detection node and the detection results of other detection nodes;

[0220] Step 404: Obtain the response speed of each detection node in detecting the target domain name;

[0221] Step 405: Determine the target response rate corresponding to each detection node according to the response rate and result consistency rate corresponding to each detection node;

[0222] Step 406: Determine a first weight corresponding to the target response rate and a second weight corresponding to the response speed;

[0223] Step 407: multiply the target response rate by the first weight to obtain a first result, and multiply the second weight by the response speed to obtain a second result;

[0224] Step 408: Add the first result and the second result to obtain a first trust value corresponding to each detection node;

[0225] Step 409: determine multiple detection time points, and obtain a first trust value corresponding to each detection node in each node cluster at each detection time point;

[0226] Step 410: multiply the first trust value corresponding to each detection node in each node cluster at each detection time point by the corresponding preset weight coefficient and add them together to obtain the target first trust value corresponding to each detection node in each node cluster;

[0227] Step 411: Add the target first trust values ​​corresponding to each detection node in each node cluster and divide the sum by the total number of detection nodes used for domain name detection in each node cluster to obtain a second trust value for each node cluster;

[0228] Step 412: selecting at least one target node cluster that can be trusted from multiple node clusters according to the second trust value;

[0229] Step 413: Perform network risk detection on the domain name to be detected according to the detection nodes in at least one target node cluster to obtain a network risk detection result.

[0230] In the above embodiments, the description of each embodiment has its own emphasis. For the part that is not described in detail in a certain embodiment, please refer to the detailed description of the domain name risk detection method above, which will not be repeated here.

[0231] See also Figure 6 , Figure 6 1 is a schematic diagram of the structure of a domain name risk detection device provided in an embodiment of the present application. The domain name risk detection device can be used to execute the domain name risk detection method in the above embodiment.

[0232] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program that has a predetermined function and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories), or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the function of the module or unit.

[0233] like Figure 6 As shown, the domain name risk detection device 500 may include:

[0234] A first determination module 510 is used to determine a plurality of detection nodes, and divide the plurality of detection nodes into a plurality of node clusters according to geographic location information of each detection node;

[0235] The second determination module 520 is used to obtain the detection result of each detection node detecting the target domain name in each node cluster, and determine the first trust value corresponding to each detection node according to the detection result;

[0236] A third determination module 530, configured to determine a second trust value of each node cluster according to the first trust value corresponding to each detection node in each node cluster;

[0237] A selection module 540, configured to select at least one trustworthy target node cluster from a plurality of node clusters according to the second trust value;

[0238] The detection module 550 is used to perform network risk detection on the domain name to be detected according to the detection nodes in at least one target node cluster to obtain a network risk detection result.

[0239] In some embodiments, the second determination module 520 includes a first acquisition submodule, a first determination submodule, a second acquisition submodule, and a second determination submodule;

[0240] The first acquisition submodule is used to obtain the response rate of each detection node to detect the target domain name;

[0241] A first determination submodule is used to determine the result consistency rate between the detection result of each detection node and the detection results of other detection nodes;

[0242] The second acquisition submodule is used to obtain the response speed of each detection node to detect the target domain name;

[0243] The second determination submodule is used to determine the first trust value corresponding to each detection node according to the response speed, response rate and result consistency rate corresponding to each detection node.

[0244] In some embodiments, the first acquisition submodule is used to determine, in each node cluster, a preset number of detection times performed by each detection node on the target domain name within a preset time range;

[0245] Get the actual number of detections of the target domain name by each detection node within the preset time range;

[0246] The actual detection times of each detection node are divided by the preset detection times to obtain the detection response rate corresponding to each detection node.

[0247] In some embodiments, the second acquisition submodule is used to determine, in each node cluster, a first number of detection nodes that respond each time the target domain name is detected within a preset time range;

[0248] determining a second number of detection nodes having detection results identical to the detection result of each detection node;

[0249] Divide the second number by the first number to obtain a sub-result consistency rate corresponding to each detection node when the target domain name is detected each time within a preset time range;

[0250] The sub-result consistency rates corresponding to each detection node when detecting the target domain name each time are added up and then divided by the preset number of detections to obtain the result consistency rate between the detection result of each detection node and the detection results of other detection nodes.

[0251] In some embodiments, the second acquisition submodule is used to obtain the response delay of each detection node in the plurality of node clusters each time the target domain name is detected, and determine the maximum response delay;

[0252] Subtract the response delay of each detection node from the maximum response delay and divide it by the maximum response delay to obtain the relative response delay corresponding to each detection node;

[0253] The relative response delay corresponding to each detection node is multiplied by the preset adjustment coefficient to obtain the response speed of each detection node for detecting the target domain name.

[0254] In some embodiments, the second determination submodule is used to determine the target response rate corresponding to each detection node according to the response rate and result consistency rate corresponding to each detection node;

[0255] Determine a first weight corresponding to the target response rate and a second weight corresponding to the response speed;

[0256] The target response rate is multiplied by the first weight to obtain a first result, and the second weight is multiplied by the response speed to obtain a second result;

[0257] The first result and the second result are added together to obtain a first trust value corresponding to each detection node.

[0258] In some implementations, the third determination module 530 is used to determine multiple detection time points, and obtain a first trust value corresponding to each detection node in each node cluster at each detection time point;

[0259] The first trust value corresponding to each detection node in each node cluster at each detection time point is multiplied by the corresponding preset weight coefficient and then added to obtain the target first trust value corresponding to each detection node in each node cluster;

[0260] The target first trust value corresponding to each detection node in each node cluster is added and then divided by the total number of detection nodes used for domain name detection in each node cluster to obtain the second trust value of each node cluster.

[0261] In some embodiments, the detection module 550 is used to input a query instruction to each detection node for domain name detection in at least one target node cluster;

[0262] Obtain the detection result of each detection node used for domain name detection after detecting the domain name to be detected according to the query instruction;

[0263] The network risk detection result of the domain name to be detected is determined according to the detection results of multiple detection nodes used for domain name detection.

[0264] In some implementations, the first determination module 510 is configured to sort the plurality of node clusters from high to low according to the second trust value to obtain a sorting result;

[0265] At least one target node cluster with a top ranking is selected from the multiple node clusters according to the ranking result.

[0266] In some embodiments, the second determination module 520 further includes a detection submodule, which is used to determine a corresponding target detection node in each node cluster, and the target detection node is used to monitor other detection nodes in each node cluster;

[0267] In each node cluster, a detection result of each detection node except the target detection node detecting the target domain name is obtained according to the target detection node.

[0268] In some embodiments, the detection submodule is used to obtain the number of votes of each candidate detection node for the campaign target detection node in each node cluster, and the number of votes is determined based on the voting information of other detection nodes other than each candidate detection node;

[0269] The candidate detection node with the largest number of votes is determined as the target detection node.

[0270] In some implementations, the first determination module 510 is configured to cluster multiple detection nodes according to the geographic location information of each detection node to obtain multiple geographic location categories;

[0271] Multiple detection nodes corresponding to each geographical location category are determined as a node cluster to obtain multiple node clusters.

[0272] In the above embodiments, the description of each embodiment has its own emphasis. For the part that is not described in detail in a certain embodiment, please refer to the detailed description of the domain name risk detection method above, which will not be repeated here.

[0273] In an embodiment of the present application, a first determination module 510 determines a plurality of detection nodes, and divides the plurality of detection nodes into a plurality of node clusters according to the geographic location information of each detection node; a second determination module 520 obtains the detection result of each detection node detecting the target domain name in each node cluster, and determines a first trust value corresponding to each detection node according to the detection result; a third determination module 530 determines a second trust value of each node cluster according to the first trust value corresponding to each detection node in each node cluster; a selection module 540 selects at least one target node cluster that can be trusted from the plurality of node clusters according to the second trust value; and a detection module 550 performs network risk detection on the domain name to be detected according to the detection nodes in at least one target node cluster, and obtains a network risk detection result. In this way, the first trust value of each detection node is determined by the detection result of each detection node in each node cluster detecting the target domain name, and then the second trust value of each node cluster is determined according to the first trust value of each detection node in each node cluster. Since each detection node in the target node cluster has obtained the first trust value of each detection node by detecting the target domain name, the credibility of the second trust value of each node cluster determined by the first trust value is relatively high, and at least one trusted target node cluster can be determined according to the second trust value. The network risk detection of the domain name to be detected is implemented through the detection nodes in the target node cluster to obtain the network risk detection result. Compared with the related art of directly trusting any detection nodes in the distributed detection nodes to realize network risk detection of the domain name, in the present application, the detection nodes of the trusted node cluster are selected to perform network risk detection on the domain name to be detected, so as to improve the accuracy of network risk detection of the domain name to be detected through multiple detection nodes.

[0274] The embodiment of the present application also provides a computer device, the computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the above domain name risk detection method when executing the computer program. The computer device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0275] See also Figure 7, Figure 7 The hardware structure of a computer device according to another embodiment is shown, and the computer device includes:

[0276] The processor 601 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0277] The memory 602 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 602 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 602, and the processor 601 calls and executes the domain name risk detection method of the embodiment of this application;

[0278] Input / output interface 603, used to implement information input and output;

[0279] Communication interface 604, used to realize communication interaction between the device and other devices, which can be realized through wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WIFI, Bluetooth, etc.);

[0280] A bus 605 that transmits information between the various components of the device (e.g., the processor 601, the memory 602, the input / output interface 603, and the communication interface 604);

[0281] The processor 601 , the memory 602 , the input / output interface 603 and the communication interface 604 are connected to each other in communication within the device via a bus 605 .

[0282] An embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned domain name risk detection method is implemented.

[0283] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0284] The domain name risk detection method, domain name risk detection device, computer equipment and storage medium provided in the embodiments of the present application determine multiple detection nodes, and divide the multiple detection nodes into multiple node clusters according to the geographical location information of each detection node; obtain the detection result of each detection node on the target domain name in each node cluster, and determine the first trust value corresponding to each detection node according to the detection result; determine the second trust value of each node cluster according to the first trust value corresponding to each detection node in each node cluster; select at least one target node cluster that can be trusted from the multiple node clusters according to the second trust value; perform network risk detection on the domain name to be detected according to the detection nodes in at least one target node cluster, and obtain a network risk detection result. In this way, the first trust value of each detection node is determined by the detection result of each detection node in each node cluster detecting the target domain name, and then the second trust value of each node cluster is determined according to the first trust value of each detection node in each node cluster. Since each detection node in the target node cluster has obtained the first trust value of each detection node by detecting the target domain name, the credibility of the second trust value of each node cluster determined by the first trust value is relatively high, and at least one trusted target node cluster can be determined according to the second trust value. The network risk detection of the domain name to be detected is implemented through the detection nodes in the target node cluster to obtain the network risk detection result. Compared with the related art of directly trusting any detection nodes in the distributed detection nodes to realize network risk detection of the domain name, in the present application, the detection nodes of the trusted node cluster are selected to perform network risk detection on the domain name to be detected, so as to improve the accuracy of network risk detection of the domain name to be detected through multiple detection nodes.

[0285] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0286] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0287] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0288] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0289] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0290] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0291] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0292] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0293] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0294] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0295] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

[0296] The above is a detailed introduction to a domain name risk detection method, device, computer equipment and storage medium provided in the embodiments of the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for technical personnel in this field, according to the ideas of the present application, there will be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A domain name risk detection method, characterized in that: include: Determine a plurality of detection nodes, and divide the plurality of detection nodes into a plurality of node clusters according to geographic location information of each detection node; Obtaining a response rate of each detection node for detecting the target domain name; Determine the result consistency rate between the detection result of each detection node and the detection results of other detection nodes; Obtaining a response speed of each detection node for detecting the target domain name; Determining a first trust value corresponding to each detection node according to the response speed, the response rate, and the result consistency rate corresponding to each detection node; Determine multiple detection time points, and obtain a first trust value corresponding to each detection node in each node cluster at each detection time point; The first trust value corresponding to each detection node in each node cluster at each detection time point is multiplied by the corresponding preset weight coefficient and then added to obtain the target first trust value corresponding to each detection node in each node cluster; Add the target first trust values ​​corresponding to each detection node in each node cluster and divide the sum by the total number of detection nodes used for domain name detection in each node cluster to obtain a second trust value for each node cluster; selecting at least one target node cluster that can be trusted from the multiple node clusters according to the second trust value; A network risk detection is performed on the domain name to be detected according to the detection node in the at least one target node cluster to obtain a network risk detection result.

2. The domain name risk detection method according to claim 1, characterized in that: The obtaining of the response rate of each detection node for detecting the target domain name includes: In each of the node clusters, determining a preset number of detection times performed by each detection node on the target domain name within a preset time range; Obtaining the actual number of detections performed by each detection node on the target domain name within the preset time range; The actual detection times of each detection node are divided by the preset detection times to obtain the detection response rate corresponding to each detection node.

3. The domain name risk detection method according to claim 2, characterized in that: The determining of the result consistency rate between the detection result of each detection node and the detection results of other detection nodes includes: In each of the node clusters, determining a first number of detection nodes that respond each time the target domain name is detected within a preset time range; Determine a second number of detection nodes having detection results that are the same as the detection result of each detection node; Dividing the second number by the first number, to obtain a sub-result consistency rate corresponding to each detection node when the target domain name is detected each time within the preset time range; The sub-result consistency rates corresponding to each detection node when the target domain name is detected each time are added and then divided by the preset number of detections to obtain the result consistency rate between the detection result of each detection node and the detection results of other detection nodes.

4. The domain name risk detection method according to claim 1, characterized in that: The obtaining of the response speed of each detection node for detecting the target domain name includes: Each time the target domain name is detected, a response delay of each detection node in the plurality of node clusters is obtained, and a maximum response delay is determined; Subtract the response delay of each detection node from the maximum response delay and divide the result by the maximum response delay to obtain a relative response delay corresponding to each detection node; The relative response delay corresponding to each detection node is multiplied by a preset adjustment coefficient to obtain a response speed of each detection node for detecting the target domain name.

5. The domain name risk detection method according to claim 1, characterized in that: The determining, according to the response speed, the response rate, and the result consistency rate corresponding to each detection node, a first trust value corresponding to each detection node includes: Determining a target response rate corresponding to each detection node according to the response rate corresponding to each detection node and the result consistency rate; Determine a first weight corresponding to the target response rate and a second weight corresponding to the response speed; Multiplying the target response rate by the first weight to obtain a first result, and multiplying the second weight by the response speed to obtain a second result; The first result and the second result are added together to obtain a first trust value corresponding to each detection node.

6. The domain name risk detection method according to claim 1, characterized in that: The performing network risk detection on the domain name to be detected according to the detection node in the at least one target node cluster to obtain the network risk detection result includes: Inputting a query instruction to each detection node for domain name detection in the at least one target node cluster; Obtaining a detection result of each detection node used for domain name detection after detecting the domain name to be detected according to the query instruction; The network risk detection result of the domain name to be detected is determined according to the detection results of multiple detection nodes used for domain name detection.

7. The domain name risk detection method according to claim 1, characterized in that: The selecting at least one trustworthy target node cluster from the multiple node clusters according to the second trust value includes: Sort the multiple node clusters from high to low according to the second trust value to obtain a sorting result; At least one target node cluster with a higher ranking is selected from the multiple node clusters according to the ranking result.

8. The domain name risk detection method according to claim 1, characterized in that: The step of obtaining the detection result of each detection node detecting the target domain name in each node cluster includes: Determine a corresponding target detection node in each node cluster, wherein the target detection node is used to monitor other detection nodes in each node cluster; In each node cluster, a detection result of each detection node except the target detection node detecting the target domain name is obtained according to the target detection node.

9. The domain name risk detection method according to claim 8, characterized in that: Determining the corresponding target detection node in each node cluster includes: In each node cluster, the number of votes of each candidate detection node of the election target detection node is obtained, and the number of votes is determined based on the voting information of other detection nodes other than each candidate detection node; The candidate detection node with the largest number of votes is determined as the target detection node.

10. The domain name risk detection method according to claim 1, characterized in that: The step of dividing the plurality of detection nodes according to the geographical location information of each detection node to obtain a plurality of node clusters includes: Clustering the multiple detection nodes according to the geographical location information of each detection node to obtain multiple geographical location categories; Multiple detection nodes corresponding to each geographical location category are determined as a node cluster to obtain multiple node clusters.

11. A domain name risk detection device, characterized in that: include: A first determination module is used to determine a plurality of detection nodes, and divide the plurality of detection nodes into a plurality of node clusters according to geographic location information of each detection node; A first acquisition submodule is used to acquire a response rate of each detection node in detecting the target domain name; A first determination submodule is used to determine the result consistency rate between the detection result of each detection node and the detection results of other detection nodes; A second acquisition submodule is used to acquire a response speed of each detection node in detecting the target domain name; A second determination submodule, configured to determine a first trust value corresponding to each detection node according to the response speed, the response rate, and the result consistency rate corresponding to each detection node; A third determination module is used to determine multiple detection time points and obtain a first trust value corresponding to each detection node in each node cluster at each detection time point; The first trust value corresponding to each detection node in each node cluster at each detection time point is multiplied by the corresponding preset weight coefficient and then added to obtain the target first trust value corresponding to each detection node in each node cluster; Add the target first trust values ​​corresponding to each detection node in each node cluster and divide the sum by the total number of detection nodes used for domain name detection in each node cluster to obtain a second trust value for each node cluster; A selection module, configured to select at least one target node cluster that can be trusted from the multiple node clusters according to the second trust value; The detection module is used to perform network risk detection on the domain name to be detected according to the detection node in the at least one target node cluster to obtain a network risk detection result.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the domain name risk detection method according to any one of claims 1 to 10.

13. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the domain name risk detection method according to any one of claims 1 to 10 is implemented.

Images