DoH server detection method and device, electronic equipment and storage medium

Abstract

The invention provides a DoH server detection method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining at least one IP address through scanning a target network port; for each IP address, determining an IP feature vector of the IP address based on address field information, geographical location information, autonomous system information and organization information to which the IP address belongs; inputting each determined IP feature vector into a pre-trained DoH server distribution scoring model, and outputting an address score of each IP address; and for at least one target IP address of which the address score is greater than a preset score threshold, performing full DoH server detection, and determining distribution information of DoH servers. In this way, the number of IP addresses needing to be inquired and screened in a full-amount mode can be reduced, and then the detection efficiency of the DoH server is improved.

Description

Technical Field

[0001] The present application relates to the field of computer science and technology, and in particular to a detection method, device, electronic device and storage medium for a DoH server. Background Art

[0002] DNS over HTTPS (DoH) is a technology that increases security and privacy between clients and Domain Name System (DNS) servers. It sends DNS query requests via the Hypertext Transfer Protocol Secure (HTTPS) protocol, avoiding the risks of eavesdropping and tampering that traditional DNS queries may encounter.

[0003] Among them, users or devices need to know the uniform resource locator (URL) of the DoH server in advance before they can perform DNS queries. This requirement increases the complexity of configuration, especially in dynamic network environments. Usually, DoH servers are discovered by trying to connect by exhaustively enumerating various possible server configurations. It may take a lot of time to find DoH servers, resulting in low detection efficiency for DoH servers. Summary of the invention

[0004] In view of this, the purpose of the present application is to provide a DoH server detection method, device, electronic device and storage medium, which scores IP addresses through a pre-trained DoH server distribution scoring model, and performs DoH server detection on target IP addresses whose scores are greater than a preset scoring threshold, thereby reducing the number of IP addresses that need to be fully queried and screened, thereby improving the detection efficiency of the DoH server.

[0005] In a first aspect, an embodiment of the present application provides a detection method for a DoH server, the detection method comprising:

[0006] Obtain at least one IP address by scanning the target network port;

[0007] For each IP address, determine the IP feature vector of the IP address based on the address segment information, geographic location information, autonomous system information, and organization information to which the IP address belongs;

[0008] Input each determined IP feature vector into a pre-trained DoH server distribution scoring model, and output the address score of each IP address; wherein the address score of each IP address is positively correlated with the probability of occurrence of the DoH server at the IP address;

[0009] For at least one target IP address whose address score is greater than the preset score threshold, a full DoH server detection is performed to determine the distribution information of the DoH server.

[0010] In a possible implementation, for each IP feature vector, the address score of each IP address is determined by the following steps:

[0011] The IP feature vector is input into the DoH server distribution scoring model, and based on the address segment information, geographic location information, autonomous system information, and organizational information in the IP feature vector, the probability of occurrence of the target DoH server corresponding to the IP feature vector is determined in combination with the mapping relationship between the address segment information, geographic location information, autonomous system information, and organizational information and the probability of occurrence of the DoH server;

[0012] Based on the probability of occurrence of the target DoH server, the address score of the IP address is output.

[0013] In one possible implementation, for at least one target IP address whose address score is greater than a preset score threshold, full DoH server detection is performed through the following steps to determine the distribution information of the DoH server:

[0014] Establishing a Hypertext Transfer Protocol Security connection based on the target IP address, and screening out candidate IP addresses that support the Hypertext Transfer Protocol Security;

[0015] Perform certificate detection for each candidate IP address, determine the SANs field of the candidate IP address, determine an access path based on the SANs field of the candidate IP address, and send query information based on the access path;

[0016] Determine that among multiple candidate IP addresses, a candidate IP address that receives reply information for the query information and whose reply content corresponds to the query content of the query information exists on the DoH server.

[0017] In one possible implementation, the DoH server distribution scoring model is trained by the following steps:

[0018] Obtain multiple scanned sample IP addresses, as well as historical address segment information, historical geographic location information, historical autonomous system information, and historical organization information corresponding to each sample IP address;

[0019] For each sample IP address, based on the historical address segment information, historical geographic location information, historical autonomous system information, and historical organization information corresponding to the sample IP address, feature extraction and encoding conversion are performed to determine the sample IP feature vector of the sample IP address;

[0020] Calculate the probability of DoH server occurrence corresponding to each feature of each sample IP feature vector, and determine the feature weight corresponding to each feature in each sample IP feature vector;

[0021] The pre-built neural network model is trained with the sample IP feature vector and the corresponding DoH server occurrence probability as training targets to obtain the DoH server distribution scoring model.

[0022] In a possible implementation, for each sample IP address, based on historical address segment information, historical geographic location information, historical autonomous system information, and historical organization information corresponding to the sample IP address, feature extraction and encoding conversion are performed to determine a sample IP feature vector of the sample IP address, including:

[0023] For each sample IP address, based on the historical address segment information, determine the address segment classification to which the sample IP address belongs;

[0024] Based on the historical geographic location information, determine the target location to which the sample IP address belongs, encode the target location, and determine the location encoding feature;

[0025] Encoding the autonomous systems contained in the historical autonomous system information into system encoding features, and converting the historical organization information into organization numerical features;

[0026] Based on the address segment classification, the location coding feature, the system coding feature and the organization numerical feature, a sample IP feature vector of the sample IP address is determined.

[0027] In a possible implementation, the detection method further includes:

[0028] According to the preset time update frequency, based on the distribution information of the DoH server, determine the updated mapping relationship between the updated address segment information, geographic location information, autonomous system information, and organization information and the probability of DoH server appearance;

[0029] Based on the update mapping relationship, determine multiple sample update IP feature vectors and the probability of occurrence of DoH servers corresponding to each update IP feature vector;

[0030] Based on the updated IP feature vector and the probability of occurrence of the DoH server corresponding to each updated IP feature vector, the DoH server distribution scoring model is updated.

[0031] In a possible implementation manner, after obtaining at least one IP address by scanning the target network port, the detection method further includes:

[0032] If there is no historical detection information for the IP address, perform a complete DoH server detection on each IP address to determine the distribution information of the DoH server.

[0033] In a second aspect, an embodiment of the present application further provides a detection device for a DoH server, the detection device comprising:

[0034] An address acquisition module, used to acquire at least one IP address by scanning a target network port;

[0035] A feature vector determination module is used to determine, for each IP address, an IP feature vector of the IP address based on the address segment information, geographic location information, autonomous system information, and organization information to which the IP address belongs;

[0036] An address score determination module is used to input each determined IP feature vector into a pre-trained DoH server distribution score model, and output the address score of each IP address; wherein the address score of each IP address is positively correlated with the probability of occurrence of the DoH server at the IP address;

[0037] The distribution information determination module is used to perform full DoH server detection for at least one target IP address whose address score is greater than a preset score threshold, and determine the distribution information of the DoH server.

[0038] In the third aspect, an embodiment of the present application also provides an electronic device, comprising: a processor, a storage medium and a bus, wherein the storage medium stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the storage medium through the bus, and the processor executes the machine-readable instructions to perform the DoH server detection method as described in any one of the first aspects.

[0039] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the DoH server detection method as described in any one of the first aspects is executed.

[0040] The detection method, device, electronic device and storage medium of the DoH server provided in the embodiment of the present application obtain at least one IP address by scanning the target network port; for each IP address, based on the address segment information, geographic location information, autonomous system information and organizational information to which the IP address belongs, determine the IP feature vector of the IP address; input each determined IP feature vector into a pre-trained DoH server distribution scoring model, and output the address score of each IP address; for at least one target IP address whose address score is greater than a preset scoring threshold, perform a full DoH server detection to determine the distribution information of the DoH server. In this way, the IP address is scored by the pre-trained DoH server distribution scoring model, and the target IP addresses whose address scores are greater than the preset scoring threshold are screened out for quantitative DoH server detection, thereby reducing the number of IP addresses that need to be fully queried and screened, thereby improving the detection efficiency of the DoH server.

[0041] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0043] Figure 1 A flowchart of a DoH server detection method provided in an embodiment of the present application;

[0044] Figure 2 A schematic diagram of the entire detection process of the DoH server provided in an embodiment of the present application;

[0045] Figure 3 A schematic diagram of the DoH server distribution scoring model construction process provided in an embodiment of the present application;

[0046] Figure 4 Schematic diagram of the full detection process of the DoH server provided in the embodiment of the present application;

[0047] Figure 5 One of the structural schematic diagrams of a detection device of a DoH server provided in an embodiment of the present application;

[0048] Figure 6 A second structural diagram of a detection device for a DoH server provided in an embodiment of the present application;

[0049] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0050] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application usually described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, each other embodiment obtained by those skilled in the art without making creative work belongs to the scope of protection of the present application.

[0051] First, the application scenarios to which the present application is applicable are introduced. The present application can be applied in the field of computer science and technology.

[0052] DNS over HTTPS (DoH) is a technology that increases security and privacy between clients and Domain Name System (DNS) servers. It sends DNS query requests via the Hypertext Transfer Protocol Secure (HTTPS) protocol, avoiding the risks of eavesdropping and tampering that traditional DNS queries may encounter.

[0053] While DoH provides significant security and privacy benefits, it also brings new challenges, especially in server discovery. Users or devices need to know the URL of the DoH server in advance to perform DNS queries. This requirement increases the complexity of configuration, especially in dynamic network environments, where manually configuring the DoH server may not be the optimal solution.

[0054] For most ordinary users, the current method of discovering DoH servers is mainly through public search through search engines. For research or other related work, discovering DoH servers is mainly done by trying to connect to various possible server configurations.

[0055] Obviously, the number of DoH servers publicly found through search engines is very small, and most of them are concentrated in a few large Internet service providers, which will cause the use of DoH services to be too centralized and create security risks.

[0056] In research, the method of trying to discover DoH servers by exhaustively connecting to various possible server configurations is usually used, but the detection efficiency of DoH servers is low.

[0057] Based on this, an embodiment of the present application provides a DoH server detection method to reduce the number of IP addresses that need to be fully queried and screened, thereby improving the detection efficiency of the DoH server.

[0058] See also Figure 1 , Figure 1 This is a flow chart of a DoH server detection method provided in an embodiment of the present application. Figure 1 As shown in , the detection method of the DoH server provided in the embodiment of the present application includes:

[0059] S101. Obtain at least one IP address by scanning a target network port.

[0060] S102. For each IP address, determine the IP feature vector of the IP address based on the address segment information, geographic location information, autonomous system information, and organization information to which the IP address belongs.

[0061] S103. Input each determined IP feature vector into a pre-trained DoH server distribution scoring model, and output the address score of each IP address; wherein the address score of each IP address is positively correlated with the probability of occurrence of the DoH server at the IP address.

[0062] S104. For at least one target IP address whose address score is greater than a preset score threshold, perform a full DoH server detection to determine the distribution information of the DoH server.

[0063] The DoH server detection method provided in the embodiment of the present application scores IP addresses through a pre-trained DoH server distribution scoring model, and performs DoH server detection on target IP addresses whose scores are greater than a preset scoring threshold, thereby reducing the number of IP addresses that need to be fully queried and screened, thereby improving the detection efficiency of the DoH server.

[0064] The following is a description of the exemplary steps of the present application embodiment:

[0065] S101. Obtain at least one IP address by scanning a target network port.

[0066] In the embodiments of the present application, DNS over HTTPS (DoH) is a technology that increases security and privacy protection between the client and the Domain Name System (DNS) server. It sends DNS query requests through the Hypertext Transfer Protocol Secure (HTTPS) protocol, avoiding the risks of eavesdropping and tampering that may be encountered in traditional DNS queries.

[0067] Among them, users or devices need to know the URL of the DoH server in advance before they can perform DNS queries. This requirement increases the complexity of configuration, especially in a dynamic network environment, it may take a lot of time to find the DoH server, resulting in low efficiency in finding the DoH server and DNS queries.

[0068] In a possible implementation, when the IP address can be obtained by scanning a network port through a scanning tool, illustratively, the scanning tool can be Zmap.

[0069] Among them, the target network port is port 443, which is the web browsing port and is mainly used for HTTPS services. It is another HTTP that provides encryption and transmission through a secure port. According to the relevant provisions of RFC8484, DoH services must be deployed on port 443. By scanning the target network port, IP addresses that do not exist in DoH servers can be filtered out, further reducing the number of IP addresses that need to be fully queried and filtered, thereby improving the efficiency of DoH server detection.

[0070] In one possible implementation, when predicting features for an IP address, it is necessary to perform screening in combination with historical feature information of the IP address. However, if it is the first detection, it is not possible to perform screening in combination with historical information. In this case, it is necessary to complete scanning and screening of the IP address to determine the distribution of DoH servers on each IP address, and to train the DoH server distribution scoring model in combination with the distribution of the scanned DoH servers to ensure the accuracy of the DoH server distribution scoring model.

[0071] Specifically, after the step of "obtaining at least one IP address by scanning the target network port", the detection method further includes:

[0072] a1: If there is no historical detection information for the IP address, perform a complete DoH server detection on each IP address to determine the distribution information of the DoH server.

[0073] In an embodiment of the present application, the DoH server detection for each IP address can be a method of discovering the DoH server by exhaustively enumerating various possible server configurations for connection, determining the distribution of DoH servers on each IP address, and then obtaining the distribution information of the DoH server.

[0074] Among them, the distribution information of DoH servers may include whether there is a DoH server on each IP address, and how many DoH servers there are.

[0075] Furthermore, for the acquired IP addresses, it is necessary to determine the IP feature vector of each IP address. For each IP address, the IP feature vector is determined by the address segment, geographical location, autonomous system and organization to which the IP address belongs.

[0076] S102. For each IP address, determine the IP feature vector of the IP address based on the address segment information, geographic location information, autonomous system information, and organization information to which the IP address belongs.

[0077] Specifically, IP addresses can be classified according to address segments such as IPv4's / 24 subnet; the geographical location information corresponding to the IP address can refer to the country and region to which the IP address belongs; autonomous system (AS), in the Internet, an autonomous system (AS) is a small unit that has the right to independently decide on the various routing protocols that should be used in the system. This network unit can be a simple network or a network group controlled by one or more ordinary network administrators. It is a separate manageable network unit (such as a university, an enterprise or an individual company). An autonomous system is sometimes also called a routing domain; organizational information represents the organizational information to which the IP address belongs. The above information can be queried through public information databases.

[0078] In a possible implementation, the address segment information, geographic location information, autonomous system information, and organization information to which each IP address belongs may be encoded to obtain an IP feature vector of each IP address.

[0079] Furthermore, the obtained IP feature vector is input into a pre-trained DoH server distribution scoring model to output the address score of each IP address. Then, after screening according to each IP address, the IP addresses where DoH servers may exist and with a higher probability of the existence of DoH servers are determined for full detection to obtain the distribution of DoH servers.

[0080] S103. Input each determined IP feature vector into a pre-trained DoH server distribution scoring model, and output the address score of each IP address; wherein the address score of each IP address is positively correlated with the probability of occurrence of the DoH server at the IP address.

[0081] In one possible implementation, the address score of each IP address is proportional to the probability of occurrence of the DoH server at the IP address. The DoH server distribution scoring model analyzes each feature in the IP feature vector corresponding to each IP address, and then determines the probability of occurrence of the DoH server in the IP address, and outputs the address score of the IP address.

[0082] Specifically, for each IP feature vector, the address score of each IP address is determined by the following steps:

[0083] b1: Input the IP feature vector into the DoH server distribution scoring model, and determine the probability of occurrence of the target DoH server corresponding to the IP feature vector based on the address segment information, geographic location information, autonomous system information and organizational information in the IP feature vector and the mapping relationship between the address segment information, geographic location information, autonomous system information and organizational information and the probability of occurrence of the DoH server.

[0084] b2: Based on the probability of occurrence of the target DoH server, output the address score of the IP address.

[0085] In one possible implementation, the address score is a score between 0 and 1, corresponding to the probability of occurrence of the target DoH server, and the address score of each IP address is positively correlated with the probability of occurrence of the DoH server at the IP address, that is, the greater the probability of the existence of a DoH server at the IP address, the higher the address score of the IP address.

[0086] For example, if the DoH server distribution scoring model calculates that the probability that a DoH server exists at the current IP address is 80%, then the score of the IP address output by the DoH server distribution scoring model may be 0.8.

[0087] In a possible implementation, in order to ensure the accuracy of determining the existence of DoH servers on each IP address, it is necessary to ensure the accuracy of training the DoH server distribution scoring model. The training process of the DoH server distribution scoring model will be described below.

[0088] Specifically, the DoH server distribution scoring model is trained by the following steps:

[0089] c1: Obtain multiple sample IP addresses scanned, as well as the historical address segment information, historical geographic location information, historical autonomous system information, and historical organization information corresponding to each sample IP address.

[0090] c2: For each sample IP address, based on the historical address segment information, historical geographic location information, historical autonomous system information, and historical organization information corresponding to the sample IP address, feature extraction and encoding conversion are performed to determine the sample IP feature vector of the sample IP address.

[0091] c3: Calculate the probability of DoH server occurrence corresponding to each feature of each sample IP feature vector, and determine the feature weight corresponding to each feature in each sample IP feature vector.

[0092] c4: Train the pre-built neural network model with the sample IP feature vector and the corresponding DoH server occurrence probability as training targets to obtain the DoH server distribution scoring model.

[0093] In an embodiment of the present application, it is necessary to obtain multiple scanned sample IP addresses, and at the same time obtain the historical address segment information, historical geographic location information, historical autonomous system information and historical organization information corresponding to each sample IP address, and for each sample IP address, determine the sample IP feature vector of the sample IP address, wherein for the historical address segment information, historical geographic location information, historical autonomous system information and historical organization information of each sample IP address, feature extraction is required to obtain the corresponding sample IP feature vector.

[0094] Specifically, the step of "for each sample IP address, based on the historical address segment information, historical geographic location information, historical autonomous system information, and historical organization information corresponding to the sample IP address, performing feature extraction and encoding conversion to determine the sample IP feature vector of the sample IP address" includes:

[0095] d1: For each sample IP address, based on the historical address segment information, determine the address segment category to which the sample IP address belongs.

[0096] d2: Based on the historical geographic location information, determine the target location to which the sample IP address belongs, encode the target location, and determine the location coding feature.

[0097] d3: Encode the autonomous system contained in the historical autonomous system information into a system encoding feature, and convert the historical organization information into an organization numerical feature.

[0098] d4: Determine a sample IP feature vector of the sample IP address based on the address segment classification, the location coding feature, the system coding feature, and the organization numerical feature.

[0099] In one possible implementation, for historical address segment information, it is necessary to determine the corresponding features based on the address segment classification to which the corresponding sample IP address belongs, exemplarily, the / 24 subnet of IPv4; for historical geographic location information, each country or region has corresponding unique coding information, and the target location (country / region) to which the sample IP address belongs is encoded to obtain the location coding feature; similarly, autonomous systems and organizations also have corresponding unique coding information, and the autonomous systems and organizations to which the sample IP addresses belong are encoded respectively to obtain system coding features and organizational numerical features.

[0100] Furthermore, the address segment classification, location coding features, system coding features and organizational numerical features are combined in a preset order to obtain a sample IP feature vector.

[0101] In one possible implementation, after determining the sample IP feature vectors of each sample IP address, the probability of occurrence of a DoH server under each feature in the IP feature vector is determined based on historical information on detection of each IP address, and the feature weights corresponding to each feature are determined, and then the subsequent calculation credentials for the address score are affected based on the corresponding feature weights.

[0102] Furthermore, taking the sample IP feature vector and the corresponding DoH server occurrence probability as training targets, a machine learning algorithm is used to train the pre-built neural network model to obtain the DoH server distribution scoring model.

[0103] Among them, the machine learning algorithm can be at least one of logistic regression, random forest, and gradient boosting.

[0104] Furthermore, after the address score of each IP address is output through the DoH server distribution scoring model, the IP addresses that meet the requirements are screened out for full DoH server detection, and then the distribution information of the DoH server is determined.

[0105] S104. For at least one target IP address whose address score is greater than a preset score threshold, perform a full DoH server detection to determine the distribution information of the DoH server.

[0106] In the embodiment of the present application, the setting of the preset scoring threshold is generally set in combination with the IP address scanning requirements (number of IP address scans) and the network conditions, and the preset scoring thresholds for different scanning rounds may be different; illustratively, first, based on the address score of the current IP address, a higher preset scoring threshold is set to filter out IP addresses whose address scores meet the requirements. After screening, if the IP address does not meet the requirements for the number of IP address scans, the preset scoring threshold can be appropriately lowered, and then the IP address screening is performed until the requirements for the number of IP address scans are met.

[0107] Here, only performing full DoH server detection on IP addresses whose address scores are greater than the preset score threshold can reduce the number of IP address detections and further improve the efficiency of DoH server detection.

[0108] Specifically, for at least one target IP address whose address score is greater than a preset score threshold, the following steps are performed to detect all DoH servers and determine the distribution information of the DoH servers:

[0109] e1: Establishing a HTTP security protocol connection based on the target IP address, and screening out candidate IP addresses that support the HTTP security protocol.

[0110] e2: Perform certificate detection for each candidate IP address, determine the SANs field of the candidate IP address, determine the access path based on the SANs field of the candidate IP address, and send query information based on the access path.

[0111] e3: Determine that among multiple candidate IP addresses, a candidate IP address that receives reply information for the query information and whose reply content corresponds to the query content of the query information exists in the DoH server.

[0112] In the embodiment of the present application, because the DoH service is based on the HTTPS protocol, it is necessary to establish a Hypertext Transfer Protocol Security connection through the screened target IP address, and at the same time, screen out candidate IP addresses that support the Hypertext Transfer Protocol Security.

[0113] Furthermore, a certificate detection is performed for each candidate IP address to obtain the Subject Alternative Name (SANs) field in the SSL / TLS certificate of the candidate IP address. This field usually contains all domain name information supported by the service, and can include, for example, email addresses, IP addresses, URIs, DNS names, directory names, etc.

[0114] In one possible implementation, potential DoH services are identified based on the certificate SANs field. After obtaining the domain name in the SANs field, a URL path is concatenated in the form of prefix + domain name + suffix or IP + suffix, and the path is accessed and the response information is collected. The prefix is ​​usually composed of two fields, "doh" or "dns", and the suffix usually includes fields such as "\dns-query", "\", and ", resolve", which are concatenated in a combined arrangement.

[0115] In one possible implementation, for an IP address with a DoH server, it can generally receive and reply to DNS query information. If a reply message is received, and the format of the reply message is correct, and the reply content of the reply message corresponds to the query content of the query information, it is determined that a DoH server exists for the candidate IP address.

[0116] Among them, the correspondence between the content of the reply information and the query content of the query information represents that the reply information correctly presents the content queried by the query information. For example, if the query information indicates to query a specific website, and the reply information displays a specific website link, it means that the content of the reply information corresponds to the query content of the query information.

[0117] In one possible implementation, in order to ensure the timeliness and accuracy of the DoH server distribution scoring model detection, it is necessary to update the DoH server distribution scoring model according to the preset time update frequency, based on the latest updated IP feature vector and the probability of occurrence of the DoH server corresponding to each updated IP feature vector.

[0118] Specifically, the detection method further includes:

[0119] f1: According to the preset time update frequency, based on the distribution information of the DoH server, determine the updated mapping relationship between the updated address segment information, geographic location information, autonomous system information and organization information and the probability of DoH server appearance.

[0120] f2: Based on the update mapping relationship, determine multiple sample update IP feature vectors and the probability of occurrence of the DoH server corresponding to each update IP feature vector.

[0121] f3: Based on the updated IP feature vector and the probability of occurrence of the DoH server corresponding to each updated IP feature vector, update the DoH server distribution scoring model.

[0122] In an embodiment of the present application, as the distribution of DoH servers in different address segments, geographic locations, autonomous systems or organizations is updated (the number of DoH servers increases or decreases), the probability of occurrence of DoH servers in the same address segment, geographic location, autonomous system or organization will also change accordingly, and the mapping relationship between the address segment information, geographic location information, autonomous system information and organizational information and the probability of occurrence of DoH servers will also change. At this time, the mapping relationship in the DoH server distribution scoring model will no longer be accurate, and it is necessary to update and adjust the updated mapping relationship between the updated address segment information, geographic location information, autonomous system information and organizational information and the probability of occurrence of DoH servers, thereby ensuring the timeliness and accuracy of the DoH server distribution scoring model detection.

[0123] Here, the process of updating the DoH server distribution scoring model through the updated mapping relationship between the updated address segment information, geographic location information, autonomous system information, and organization information and the probability of DoH server occurrence is consistent with the process of training the DoH server distribution scoring model, and will not be repeated here.

[0124] In a possible implementation, the preset time update frequency can be set according to actual needs or the update frequency of the DoH server, and is not specifically limited here.

[0125] The following will use specific examples to illustrate the detection process of the DoH server in the embodiment of the present application.

[0126] See also Figure 2 , Figure 2 A schematic diagram of the entire detection process of the DoH server provided in the embodiment of the present application is shown in FIG. Figure 2 As shown, first scan the active IP addresses of port 443; input the scanned IP addresses into the DoH server distribution scoring model, and determine the preset scoring threshold according to the actual network conditions; perform a full DoH server detection on the screened target IP addresses, and further update the DoH server distribution scoring model according to the scan results.

[0127] See also Figure 3 , Figure 3 This is a schematic diagram of the DoH server distribution scoring model construction process provided in the embodiment of the present application, such as Figure 3 As shown, data collection and preprocessing are first performed, and then feature extraction is performed. A model is built based on the extracted feature vectors, and then the score is calculated through the constructed model. Finally, the model is optimized and updated.

[0128] See also Figure 4 , Figure 4This is a schematic diagram of the full detection process of the DoH server provided in the embodiment of the present application, such as Figure 4 As shown, enter the IP address, try to establish an HTTPS connection to the IP address, and obtain the HTTPS certificate; obtain the SANs field in the HTTPS certificate, concatenate the prefix and suffix of the DoH server according to the certificate SANs field, and use it as the domain name for detection to determine whether the reply result is a normal DNS message, and then obtain the judgment result of whether there is a DoH server at the IP address.

[0129] For example, by scoring and screening IP addresses through the DoH server distribution scoring model, approximately 19,000 DoH servers were discovered after only detecting 430,000 nodes. Using the traditional full-scale detection method, 22,000 servers were discovered by scanning 37 million addresses, significantly improving the detection efficiency of DoH servers.

[0130] The detection method of the DoH server provided in the embodiment of the present application obtains at least one IP address by scanning the target network port; for each IP address, the IP feature vector of the IP address is determined based on the address segment information, geographic location information, autonomous system information and organizational information to which the IP address belongs; each determined IP feature vector is input into a pre-trained DoH server distribution scoring model, and the address score of each IP address is output; for at least one target IP address whose address score is greater than a preset scoring threshold, a full DoH server detection is performed to determine the distribution information of the DoH server. In this way, the IP address is scored by the pre-trained DoH server distribution scoring model, and the target IP addresses whose address scores are greater than the preset scoring threshold are screened out for quantitative DoH server detection, thereby reducing the number of IP addresses that need to be fully queried and screened, thereby improving the detection efficiency of the DoH server.

[0131] Based on the same inventive concept, the embodiments of the present application also provide a detection device for a DoH server corresponding to the detection method for a DoH server. Since the principle of solving the problem by the device in the embodiments of the present application is similar to the detection method for a DoH server in the embodiments of the present application, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0132] See also Figure 5 , Figure 6 , Figure 5 This is one of the structural schematic diagrams of a detection device for a DoH server provided in an embodiment of the present application, Figure 6 This is a second structural diagram of a detection device for a DoH server provided in an embodiment of the present application. Figure 5 As shown in , the detection device 500 includes:

[0133] The address acquisition module 510 is used to acquire at least one IP address by scanning the target network port;

[0134] A feature vector determination module 520 is used to determine, for each IP address, an IP feature vector of the IP address based on the address segment information, geographic location information, autonomous system information, and organization information to which the IP address belongs;

[0135] An address score determination module 530 is used to input each determined IP feature vector into a pre-trained DoH server distribution scoring model, and output an address score for each IP address; wherein the address score of each IP address is positively correlated with the probability of occurrence of a DoH server at the IP address;

[0136] The distribution information determination module 540 is used to perform a full DoH server detection for at least one target IP address whose address score is greater than a preset score threshold, and determine the distribution information of the DoH server.

[0137] In a possible implementation, for each IP feature vector, the address score determination module 530 is used to determine the address score of each IP address through the following steps:

[0138] The IP feature vector is input into the DoH server distribution scoring model, and based on the address segment information, geographic location information, autonomous system information, and organizational information in the IP feature vector, the probability of occurrence of the target DoH server corresponding to the IP feature vector is determined in combination with the mapping relationship between the address segment information, geographic location information, autonomous system information, and organizational information and the probability of occurrence of the DoH server;

[0139] Based on the probability of occurrence of the target DoH server, the address score of the IP address is output.

[0140] In a possible implementation, for at least one target IP address whose address score is greater than a preset score threshold, the distribution information determination module 540 is used to perform full DoH server detection to determine the distribution information of the DoH server through the following steps:

[0141] Establishing a Hypertext Transfer Protocol Security connection based on the target IP address, and screening out candidate IP addresses that support the Hypertext Transfer Protocol Security;

[0142] Perform certificate detection for each candidate IP address, determine the SANs field of the candidate IP address, determine an access path based on the SANs field of the candidate IP address, and send query information based on the access path;

[0143] Determine that among multiple candidate IP addresses, a candidate IP address that receives reply information for the query information and whose reply content corresponds to the query content of the query information exists on the DoH server.

[0144] In a possible implementation, Figure 6 As shown, the detection device 500 also includes a model training module 550, and the model training module 550 is used to train the DoH server distribution scoring model through the following steps:

[0145] Obtain multiple scanned sample IP addresses, as well as historical address segment information, historical geographic location information, historical autonomous system information, and historical organization information corresponding to each sample IP address;

[0146] For each sample IP address, based on the historical address segment information, historical geographic location information, historical autonomous system information, and historical organization information corresponding to the sample IP address, feature extraction and encoding conversion are performed to determine the sample IP feature vector of the sample IP address;

[0147] Calculate the probability of DoH server occurrence corresponding to each feature of each sample IP feature vector, and determine the feature weight corresponding to each feature in each sample IP feature vector;

[0148] The pre-built neural network model is trained with the sample IP feature vector and the corresponding DoH server occurrence probability as training targets to obtain the DoH server distribution scoring model.

[0149] In a possible implementation, when the model training module 550 is used to perform feature extraction and encoding conversion for each sample IP address based on historical address segment information, historical geographic location information, historical autonomous system information, and historical organization information corresponding to the sample IP address to determine the sample IP feature vector of the sample IP address, the model training module 550 is used to:

[0150] For each sample IP address, based on the historical address segment information, determine the address segment classification to which the sample IP address belongs;

[0151] Based on the historical geographic location information, determine the target location to which the sample IP address belongs, encode the target location, and determine the location encoding feature;

[0152] Encoding the autonomous systems contained in the historical autonomous system information into system encoding features, and converting the historical organization information into organization numerical features;

[0153] Based on the address segment classification, the location coding feature, the system coding feature and the organization numerical feature, a sample IP feature vector of the sample IP address is determined.

[0154] In a possible implementation, Figure 6 As shown, the detection device 500 further includes a model updating module 560, and the model updating module 560 is used to:

[0155] According to the preset time update frequency, based on the distribution information of the DoH server, determine the updated mapping relationship between the updated address segment information, geographic location information, autonomous system information, and organization information and the probability of DoH server appearance;

[0156] Based on the update mapping relationship, determine multiple sample update IP feature vectors and the probability of occurrence of DoH servers corresponding to each update IP feature vector;

[0157] Based on the updated IP feature vector and the probability of occurrence of the DoH server corresponding to each updated IP feature vector, the DoH server distribution scoring model is updated.

[0158] In a possible implementation, Figure 6 As shown, the detection device 500 further includes an address filtering module 570, and the address filtering module 570 is used to:

[0159] If there is no historical detection information for the IP address, perform a complete DoH server detection on each IP address to determine the distribution information of the DoH server.

[0160] The detection device of the DoH server provided in the embodiment of the present application obtains at least one IP address by scanning the target network port; for each IP address, the IP feature vector of the IP address is determined based on the address segment information, geographic location information, autonomous system information and organizational information to which the IP address belongs; each determined IP feature vector is input into a pre-trained DoH server distribution scoring model, and the address score of each IP address is output; for at least one target IP address whose address score is greater than a preset scoring threshold, a full DoH server detection is performed to determine the distribution information of the DoH server. In this way, the IP address is scored by the pre-trained DoH server distribution scoring model, and the target IP addresses whose address scores are greater than the preset scoring threshold are screened out for DoH server detection, thereby reducing the number of IP addresses that need to be fully queried and screened, thereby improving the detection efficiency of the DoH server.

[0161] See also Figure 7 , Figure 7This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 7 As shown in , the electronic device 700 includes a processor 710 , a memory 720 and a bus 730 .

[0162] The memory 720 stores machine-readable instructions executable by the processor 710. When the electronic device 700 is running, the processor 710 communicates with the memory 720 via the bus 730. When the machine-readable instructions are executed by the processor 710, the above-mentioned Figure 1 The steps of the DoH server detection method in the method embodiment shown, the specific implementation method can be found in the method embodiment, and will not be repeated here.

[0163] The present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the computer program can execute the above-mentioned Figure 1 The steps of the DoH server detection method in the method embodiment shown, the specific implementation method can be found in the method embodiment, and will not be repeated here.

[0164] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0165] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0166] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0167] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0168] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application can essentially be embodied in the form of a software product, or in other words, the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0169] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solutions of the present application, rather than to limit them. The protection scope of the present application is not limited thereto. Although the present application is described in detail with reference to the above-mentioned embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-mentioned embodiments within the technical scope disclosed in the present application, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A detection method for a DoH server, characterized in that: The detection method comprises: Obtain at least one IP address by scanning the target network port; For each IP address, determine the IP feature vector of the IP address based on the address segment information, geographic location information, autonomous system information, and organization information to which the IP address belongs; Input each determined IP feature vector into a pre-trained DoH server distribution scoring model, and output the address score of each IP address; wherein the address score of each IP address is positively correlated with the probability of occurrence of the DoH server at the IP address; For at least one target IP address whose address score is greater than the preset score threshold, a full DoH server detection is performed to determine the distribution information of the DoH server.

2. The detection method according to claim 1, characterized in that: For each IP feature vector, the address score of each IP address is determined by the following steps: The IP feature vector is input into the DoH server distribution scoring model, and based on the address segment information, geographic location information, autonomous system information, and organizational information in the IP feature vector, the probability of occurrence of the target DoH server corresponding to the IP feature vector is determined in combination with the mapping relationship between the address segment information, geographic location information, autonomous system information, and organizational information and the probability of occurrence of the DoH server; Based on the probability of occurrence of the target DoH server, the address score of the IP address is output.

3. The detection method according to claim 1, characterized in that: For at least one target IP address whose address score is greater than the preset score threshold, perform full DoH server detection through the following steps to determine the distribution information of DoH servers: Establishing a Hypertext Transfer Protocol Security connection based on the target IP address, and screening out candidate IP addresses that support the Hypertext Transfer Protocol Security; Perform certificate detection for each candidate IP address, determine the SANs field of the candidate IP address, determine an access path based on the SANs field of the candidate IP address, and send query information based on the access path; Determine that among multiple candidate IP addresses, a candidate IP address that receives reply information for the query information and whose reply content corresponds to the query content of the query information exists on the DoH server.

4. The detection method according to claim 1, characterized in that: The DoH server distribution scoring model is trained by the following steps: Obtain multiple scanned sample IP addresses, as well as historical address segment information, historical geographic location information, historical autonomous system information, and historical organization information corresponding to each sample IP address; For each sample IP address, based on the historical address segment information, historical geographic location information, historical autonomous system information, and historical organization information corresponding to the sample IP address, feature extraction and encoding conversion are performed to determine the sample IP feature vector of the sample IP address; Calculate the probability of DoH server occurrence corresponding to each feature of each sample IP feature vector, and determine the feature weight corresponding to each feature in each sample IP feature vector; The pre-built neural network model is trained with the sample IP feature vector and the corresponding DoH server occurrence probability as training targets to obtain the DoH server distribution scoring model.

5. The detection method according to claim 4, characterized in that: The method of performing feature extraction and encoding conversion for each sample IP address based on historical address segment information, historical geographic location information, historical autonomous system information, and historical organization information corresponding to the sample IP address to determine a sample IP feature vector of the sample IP address includes: For each sample IP address, based on the historical address segment information, determine the address segment classification to which the sample IP address belongs; Based on the historical geographic location information, determine the target location to which the sample IP address belongs, encode the target location, and determine the location encoding feature; Encoding the autonomous systems contained in the historical autonomous system information into system encoding features, and converting the historical organization information into organization numerical features; Based on the address segment classification, the location coding feature, the system coding feature and the organization numerical feature, a sample IP feature vector of the sample IP address is determined.

6. The detection method according to claim 1, characterized in that: The detection method further comprises: According to the preset time update frequency, based on the distribution information of the DoH server, determine the updated mapping relationship between the updated address segment information, geographic location information, autonomous system information, and organization information and the probability of DoH server appearance; Based on the update mapping relationship, determine multiple sample update IP feature vectors and the probability of occurrence of DoH servers corresponding to each update IP feature vector; Based on the updated IP feature vector and the probability of occurrence of the DoH server corresponding to each updated IP feature vector, the DoH server distribution scoring model is updated.

7. The detection method according to claim 1, characterized in that: After obtaining at least one IP address by scanning the target network port, the detection method further includes: If there is no historical detection information for the IP address, perform a complete DoH server detection on each IP address to determine the distribution information of the DoH server.

8. A detection device for a DoH server, characterized in that: The detection device comprises: An address acquisition module, used to acquire at least one IP address by scanning a target network port; A feature vector determination module is used to determine, for each IP address, an IP feature vector of the IP address based on the address segment information, geographic location information, autonomous system information, and organization information to which the IP address belongs; An address score determination module is used to input each determined IP feature vector into a pre-trained DoH server distribution score model, and output the address score of each IP address; wherein the address score of each IP address is positively correlated with the probability of occurrence of the DoH server at the IP address; The distribution information determination module is used to perform full DoH server detection for at least one target IP address whose address score is greater than a preset score threshold, and determine the distribution information of the DoH server.

9. An electronic device, characterized in that: include: A processor, a storage medium and a bus, wherein the storage medium stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the storage medium via the bus, and the processor executes the machine-readable instructions to perform the steps of the DoH server detection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the DoH server detection method according to any one of claims 1 to 7 are executed.

Images