Detection method and device of doh server, electronic equipment and storage medium

Abstract

The application provides a detection method and device of a DoH server, electronic equipment and a storage medium. At least one IP address is obtained by scanning a target network port. For each IP address, an IP feature vector of the IP address is determined based on address segment information, geographical location information, autonomous system information and organization information to which the IP address belongs. Each IP feature vector determined is input into a pre-trained DoH server distribution scoring model, and address scores of each IP address are output. For at least one target IP address with an address score greater than a preset score threshold, full-amount DoH server detection is performed to determine distribution information of the DoH server. In this way, the number of IP addresses that need to be screened by full-amount query can be reduced, and the detection efficiency of the DoH server can be improved.

Description

Technical Field

[0001] The present application relates to the field of computer science and technology, and in particular to a detection method, device, electronic device, and storage medium for a DoH server. Background Art

[0002] DNS over HTTPS (DoH) is a technology that increases security and privacy between clients and Domain Name System (DNS) servers. It sends DNS queries via the Hypertext Transfer Protocol Secure (HTTPS), eliminating the risks of eavesdropping and tampering associated with traditional DNS queries.

[0003] The user or device needs to know the uniform resource locator (URL) of the DoH server in advance before performing a DNS query. This requirement increases the complexity of the configuration, especially in a dynamic network environment. Usually, the DoH server is discovered by trying to connect to it by exhaustively enumerating various possible server configurations. This may take a lot of time to find the DoH server, resulting in low detection efficiency for the DoH server. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide a detection method, device, electronic device and storage medium for DoH servers, score IP addresses through a pre-trained DoH server distribution scoring model, and perform DoH server detection on target IP addresses whose address scores are greater than a preset scoring threshold, thereby reducing the number of IP addresses that need to be fully queried and screened, and thereby improving the detection efficiency of the DoH server.

[0005] In a first aspect, an embodiment of the present application provides a method for detecting a DoH server, the method comprising:

[0006] Obtain at least one IP address by scanning the target network port;

[0007] For each IP address, determine the IP feature vector of the IP address based on the address segment information, geographic location information, autonomous system information, and organization information of the IP address;

[0008] Input each determined IP feature vector into a pre-trained DoH server distribution scoring model to output the address score of each IP address; the address score of each IP address is positively correlated with the probability of the DoH server appearing at that IP address;

[0009] For at least one target IP address whose address score is greater than the preset score threshold, a full DoH server detection is performed to determine the distribution information of the DoH server.

[0010] In one possible implementation, for each IP feature vector, the address score of each IP address is determined by the following steps:

[0011] The IP feature vector is input into the DoH server distribution scoring model, and based on the address segment information, geographic location information, autonomous system information, and organization information in the IP feature vector, the probability of occurrence of the target DoH server corresponding to the IP feature vector is determined in combination with the mapping relationship between the address segment information, geographic location information, autonomous system information, and organization information and the probability of occurrence of the DoH server;

[0012] Based on the probability of occurrence of the target DoH server, the address score of the IP address is output.

[0013] In one possible implementation, for at least one target IP address whose address score is greater than a preset score threshold, a full DoH server detection is performed to determine the distribution information of the DoH servers through the following steps:

[0014] Establishing a Hypertext Transfer Protocol Security (HTTP) connection based on the target IP address and screening candidate IP addresses that support the HTTP protocol;

[0015] Perform certificate detection on each candidate IP address, determine the SANs field of the candidate IP address, determine an access path based on the SANs field of the candidate IP address, and send query information based on the access path;

[0016] Determine that among multiple candidate IP addresses, a candidate IP address that receives a reply message for the query information and whose reply content corresponds to the query content of the query information exists in the DoH server.

[0017] In one possible implementation, the DoH server distribution scoring model is trained by the following steps:

[0018] Obtain multiple sample IP addresses scanned, as well as the historical address segment information, historical geographic location information, historical autonomous system information, and historical organization information corresponding to each sample IP address;

[0019] For each sample IP address, perform feature extraction and encoding conversion based on the historical address segment information, historical geographic location information, historical autonomous system information, and historical organization information corresponding to the sample IP address to determine the sample IP feature vector of the sample IP address;

[0020] Calculate the probability of DoH server occurrence corresponding to each feature of each sample IP feature vector, and determine the feature weight corresponding to each feature in each sample IP feature vector;

[0021] The pre-built neural network model is trained with the sample IP feature vector and the corresponding DoH server occurrence probability as training targets to obtain the DoH server distribution scoring model.

[0022] In one possible implementation, for each sample IP address, performing feature extraction and encoding conversion based on historical address segment information, historical geographic location information, historical autonomous system information, and historical organization information corresponding to the sample IP address to determine a sample IP feature vector for the sample IP address includes:

[0023] For each sample IP address, determine the address segment category to which the sample IP address belongs based on the historical address segment information;

[0024] Based on the historical geographic location information, determine the target location to which the sample IP address belongs, encode the target location, and determine a location encoding feature;

[0025] Encoding the autonomous systems contained in the historical autonomous system information into system encoding features, and converting the historical organization information into organization numerical features;

[0026] Based on the address segment classification, the location coding feature, the system coding feature, and the organization numerical feature, a sample IP feature vector of the sample IP address is determined.

[0027] In a possible embodiment, the detection method further includes:

[0028] Determine, at a preset time update frequency, an updated mapping relationship between the updated address segment information, geographic location information, autonomous system information, and organization information and the probability of DoH server appearance based on the distribution information of the DoH server;

[0029] Determine, based on the update mapping relationship, multiple sample update IP feature vectors and the probability of occurrence of the DoH server corresponding to each update IP feature vector;

[0030] Based on the updated IP feature vectors and the probability of occurrence of DoH servers corresponding to each updated IP feature vector, the DoH server distribution scoring model is updated.

[0031] In a possible implementation, after obtaining at least one IP address by scanning the target network port, the detection method further includes:

[0032] If there is no historical detection information for the IP address, a complete DoH server detection is performed on each IP address to determine the distribution information of the DoH server.

[0033] In a second aspect, an embodiment of the present application further provides a detection device for a DoH server, the detection device comprising:

[0034] An address acquisition module is used to obtain at least one IP address by scanning a target network port;

[0035] A feature vector determination module is used to determine, for each IP address, an IP feature vector of the IP address based on the address segment information, geographic location information, autonomous system information, and organization information to which the IP address belongs;

[0036] An address score determination module, which is used to input the determined IP feature vectors into a pre-trained DoH server distribution scoring model and output the address score of each IP address; wherein the address score of each IP address is positively correlated with the probability of the DoH server appearing at the IP address;

[0037] The distribution information determination module is used to perform full DoH server detection for at least one target IP address whose address score is greater than a preset score threshold to determine the distribution information of the DoH server.

[0038] In a third aspect, an embodiment of the present application further provides an electronic device comprising: a processor, a storage medium, and a bus, wherein the storage medium stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the storage medium through the bus, and the processor executes the machine-readable instructions to perform the DoH server detection method as described in any one of the first aspects.

[0039] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the detection method of the DoH server as described in any one of the first aspects is executed.

[0040] The detection method, device, electronic device and storage medium of the DoH server provided in the embodiment of the present application obtain at least one IP address by scanning the target network port; for each IP address, the IP feature vector of the IP address is determined based on the address segment information, geographic location information, autonomous system information and organizational information to which the IP address belongs; each determined IP feature vector is input into a pre-trained DoH server distribution scoring model, and the address score of each IP address is output; for at least one target IP address whose address score is greater than a preset scoring threshold, a full DoH server detection is performed to determine the distribution information of the DoH server. In this way, the IP address is scored by the pre-trained DoH server distribution scoring model, and the target IP addresses whose address scores are greater than the preset scoring threshold are screened out for DoH server detection, thereby reducing the number of IP addresses that need to be fully queried and screened, thereby improving the detection efficiency of the DoH server.

[0041] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0043] Figure 1 A flowchart of a DoH server detection method provided in an embodiment of the present application;

[0044] Figure 2 Schematic diagram of the entire detection process of the DoH server provided in an embodiment of the present application;

[0045] Figure 3 Schematic diagram of the DoH server distribution scoring model construction process provided in an embodiment of the present application;

[0046] Figure 4 Schematic diagram of the full detection process of the DoH server provided in the embodiment of the present application;

[0047] Figure 5 This is a structural diagram of a detection device for a DoH server provided in an embodiment of the present application;

[0048] Figure 6 This is a second structural diagram of a detection device for a DoH server provided in an embodiment of the present application;

[0049] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application for which protection is claimed, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, each other embodiment obtained by those skilled in the art without making creative work falls within the scope of protection of the present application.

[0051] First, the application scenarios to which this application is applicable are introduced. This application can be applied in the field of computer science and technology.

[0052] DNS over HTTPS (DoH) is a technology that increases security and privacy between clients and Domain Name System (DNS) servers. It sends DNS queries via the Hypertext Transfer Protocol Secure (HTTPS), eliminating the risks of eavesdropping and tampering associated with traditional DNS queries.

[0053] While DoH offers significant security and privacy advantages, it also introduces new challenges, particularly with server discovery. Users or devices need to know the URL of the DoH server in advance to perform DNS queries. This requirement increases configuration complexity, and manual DoH server configuration may not be optimal, especially in dynamic network environments.

[0054] For most ordinary users, the current method of discovering DoH servers is mainly through public search engines. For research or other related work, the main way to discover DoH servers is to try to connect to various possible server configurations.

[0055] Obviously, the number of DoH servers publicly found through search engines is very small, and most of them are concentrated in a few large Internet service providers, which will cause the use of DoH services to be too centralized and create security risks.

[0056] In research, the method of trying to discover DoH servers by exhaustively enumerating various possible server configurations to connect to them is often used, but the detection efficiency of DoH servers is low.

[0057] Based on this, an embodiment of the present application provides a detection method for a DoH server to reduce the number of IP addresses that require full query and screening, thereby improving the detection efficiency of the DoH server.

[0058] See also Figure 1 , Figure 1 This is a flow chart of a DoH server detection method provided in an embodiment of the present application. Figure 1 As shown in , the detection method of the DoH server provided in the embodiment of the present application includes:

[0059] S101. Obtain at least one IP address by scanning a target network port.

[0060] S102. For each IP address, determine the IP feature vector of the IP address based on the address segment information, geographic location information, autonomous system information, and organization information to which the IP address belongs.

[0061] S103. Input each determined IP feature vector into a pre-trained DoH server distribution scoring model, and output the address score of each IP address; wherein the address score of each IP address is positively correlated with the probability of occurrence of the DoH server at the IP address.

[0062] S104. For at least one target IP address whose address score is greater than a preset score threshold, perform a full DoH server detection to determine the distribution information of the DoH server.

[0063] The DoH server detection method provided in the embodiment of the present application scores IP addresses through a pre-trained DoH server distribution scoring model, and performs DoH server detection on target IP addresses whose address scores are greater than a preset scoring threshold, thereby reducing the number of IP addresses that need to be fully queried and screened, thereby improving the detection efficiency of the DoH server.

[0064] The following describes the exemplary steps of the embodiment of the present application:

[0065] S101. Obtain at least one IP address by scanning a target network port.

[0066] In the embodiments of the present application, DNS over HTTPS (DoH) is a technology that increases security and privacy protection between a client and a Domain Name System (DNS) server. It sends DNS query requests through the Hypertext Transfer Protocol Secure (HTTPS) protocol, avoiding the risk of monitoring and tampering that may be encountered in traditional DNS queries.

[0067] Wherein, the user or the device needs to know the URL of the DoH server in advance, in order to carry out the DNS query. This requirement increases the complexity of configuration, especially in a dynamic network environment, it may take a lot of time to find the DoH server, resulting in low efficiency of finding the DoH server and DNS query.

[0068] In a possible implementation, the IP address can be obtained by scanning the network port through a scanning tool. For example, the scanning tool can be Zmap.

[0069] Wherein, the target network port is 443 port, which is a web browsing port, mainly used for HTTPS service, which is another HTTP that provides encryption and transmission through a secure port. According to the relevant provisions of RFC8484, DoH service must be deployed on 443 port. By scanning the target network port, IP addresses without DoH server can be filtered out, further reducing the number of IP addresses that need to be queried and filtered, and thus improving the efficiency of DoH server detection.

[0070] In a possible implementation, when predicting the characteristics of the IP address, the historical characteristic information of the IP address needs to be combined for screening. If it is the first detection, historical information cannot be combined for screening. At this time, the IP address needs to be scanned and screened to determine the distribution of DoH servers on each IP address, so as to train the DoH server distribution scoring model in combination with the distribution of the scanned DoH servers, and ensure the accuracy of the DoH server distribution scoring model.

[0071] Specifically, after the step of "obtaining at least one IP address by scanning the target network port", the detection method further comprises:

[0072] a1: If there is no historical detection information of the IP address at present, complete DoH server detection is performed on each IP address to determine the distribution information of the DoH server.

[0073] In an embodiment of the present application, the DoH server detection for each IP address can be a method of discovering the DoH server by exhaustively enumerating various possible server configurations for connection, determining the distribution of DoH servers on each IP address, and then obtaining the distribution information of the DoH server.

[0074] Among them, the distribution information of DoH servers can include whether there is a DoH server on each IP address, and how many DoH servers exist.

[0075] Furthermore, for the acquired IP addresses, it is necessary to determine the IP feature vector of each IP address. For each IP address, the IP feature vector is determined by the address segment, geographical location, autonomous system, and organization to which the IP address belongs.

[0076] S102. For each IP address, determine the IP feature vector of the IP address based on the address segment information, geographic location information, autonomous system information, and organization information to which the IP address belongs.

[0077] Specifically, IP addresses can be classified according to address segments, such as the / 24 subnet of IPv4; the geographic location information corresponding to an IP address can refer to the country and region to which the IP address belongs; an autonomous system (AS) on the Internet is a small unit that has the authority to independently decide which routing protocols should be used within the system. This network unit can be a simple network or a network group controlled by one or more ordinary network administrators. It is a separately manageable network unit (such as a university, an enterprise, or an individual company). An autonomous system is sometimes also referred to as a routing domain; organizational information represents the organization to which the IP address belongs. All of the above information can be queried through public information databases.

[0078] In a possible implementation, the address segment information, geographic location information, autonomous system information, and organization information to which each IP address belongs may be encoded to obtain an IP feature vector of each IP address.

[0079] Furthermore, the obtained IP feature vector is input into a pre-trained DoH server distribution scoring model to output the address score of each IP address. Then, after screening according to each IP address, the IP addresses where DoH servers may exist and with a higher probability of existing DoH servers can be fully detected to obtain the distribution of DoH servers.

[0080] S103. Input each determined IP feature vector into a pre-trained DoH server distribution scoring model, and output the address score of each IP address; wherein the address score of each IP address is positively correlated with the probability of occurrence of the DoH server at the IP address.

[0081] In one possible implementation, the address score of each IP address is proportional to the probability of occurrence of the DoH server at the IP address. The DoH server distribution scoring model analyzes each feature in the IP feature vector corresponding to each IP address, and then determines the probability of occurrence of the DoH server in the IP address, and outputs the address score of the IP address.

[0082] Specifically, for each IP feature vector, the address score of each IP address is determined through the following steps:

[0083] b1: Input the IP feature vector into the DoH server distribution scoring model, and based on the address segment information, geographic location information, autonomous system information and organizational information in the IP feature vector, combined with the mapping relationship between the address segment information, geographic location information, autonomous system information and organizational information and the probability of DoH server occurrence, determine the probability of occurrence of the target DoH server corresponding to the IP feature vector.

[0084] b2: Based on the probability of the target DoH server appearing, output the address score of the IP address.

[0085] In one possible implementation, the address score is a score between 0 and 1, corresponding to the probability of occurrence of the target DoH server. The address score of each IP address is positively correlated with the probability of occurrence of the DoH server at the IP address, that is, the greater the probability of the existence of a DoH server at the IP address, the higher the address score of the IP address.

[0086] For example, if the DoH server distribution scoring model calculates that the probability that a DoH server exists at the current IP address is 80%, then the score of the IP address output by the DoH server distribution scoring model may be 0.8.

[0087] In one possible implementation, in order to ensure the accuracy of determining the existence of DoH servers on each IP address, it is necessary to ensure the accuracy of training the DoH server distribution scoring model. The training process of the DoH server distribution scoring model will be explained below.

[0088] Specifically, the DoH server distribution scoring model is trained through the following steps:

[0089] c1: Obtain multiple sample IP addresses scanned, as well as the historical address segment information, historical geographic location information, historical autonomous system information, and historical organization information corresponding to each sample IP address.

[0090] c2: For each sample IP address, perform feature extraction and encoding conversion based on the historical address segment information, historical geographic location information, historical autonomous system information, and historical organization information corresponding to the sample IP address to determine the sample IP feature vector of the sample IP address.

[0091] c3: Calculate the probability of DoH server occurrence corresponding to each feature of each sample IP feature vector, and determine the feature weight corresponding to each feature in each sample IP feature vector.

[0092] c4: Train the pre-built neural network model with the sample IP feature vector and the corresponding DoH server occurrence probability as training targets to obtain the DoH server distribution scoring model.

[0093] In an embodiment of the present application, it is necessary to obtain multiple scanned sample IP addresses, and at the same time obtain the historical address segment information, historical geographic location information, historical autonomous system information and historical organization information corresponding to each sample IP address. For each sample IP address, the sample IP feature vector of the sample IP address is determined. Among them, for the historical address segment information, historical geographic location information, historical autonomous system information and historical organization information of each sample IP address, feature extraction is required to obtain the corresponding sample IP feature vector.

[0094] Specifically, the step of "for each sample IP address, performing feature extraction and encoding conversion based on the historical address segment information, historical geographic location information, historical autonomous system information, and historical organization information corresponding to the sample IP address to determine the sample IP feature vector of the sample IP address" includes:

[0095] d1: For each sample IP address, determine the address segment category to which the sample IP address belongs based on the historical address segment information.

[0096] d2: Based on the historical geographic location information, determine the target location to which the sample IP address belongs, encode the target location, and determine the location coding feature.

[0097] d3: Encode the autonomous system contained in the historical autonomous system information into a system encoding feature, and convert the historical organization information into an organization numerical feature.

[0098] d4: Determine a sample IP feature vector of the sample IP address based on the address segment classification, the location coding feature, the system coding feature, and the organization numerical feature.

[0099] In one possible implementation, for historical address segment information, it is necessary to determine the corresponding characteristics based on the address segment classification to which the corresponding sample IP address belongs, for example, the / 24 subnet of IPv4; for historical geographic location information, each country or region has corresponding unique coding information, and the target location (country / region) to which the sample IP address belongs is encoded to obtain the location coding characteristics; similarly, autonomous systems and organizations also have corresponding unique coding information, and the autonomous systems and organizations to which the sample IP addresses belong are encoded respectively to obtain system coding characteristics and organizational numerical characteristics.

[0100] Furthermore, the address segment classification, location coding features, system coding features and organizational numerical features are combined in a preset order to obtain a sample IP feature vector.

[0101] In one possible implementation, after determining the sample IP feature vectors of each sample IP address, the probability of occurrence of a DoH server under each feature in the IP feature vector is determined based on historical information on detection of each IP address, and the feature weights corresponding to each feature are determined, and then the subsequent calculation credentials for the address score are affected based on the corresponding feature weights.

[0102] Furthermore, the sample IP feature vector and the corresponding DoH server occurrence probability are used as training targets, and a machine learning algorithm is used to train the pre-built neural network model to obtain the DoH server distribution scoring model.

[0103] The machine learning algorithm may be at least one of logistic regression, random forest, and gradient boosting.

[0104] Furthermore, after outputting the address score of each IP address through the DoH server distribution scoring model, the IP addresses that meet the requirements are screened out for full DoH server detection, and then the distribution information of the DoH server is determined.

[0105] S104. For at least one target IP address whose address score is greater than a preset score threshold, perform a full DoH server detection to determine the distribution information of the DoH server.

[0106] In the embodiment of the present application, the setting of the preset scoring threshold is generally set in combination with the IP address scanning requirements (number of IP address scans) and the network conditions, and the preset scoring thresholds for different scanning rounds may be different; for example, first, based on the address score of the current IP address, a higher preset scoring threshold is set to filter out IP addresses whose address scores meet the requirements. After screening, if the IP address does not meet the requirement of the number of IP address scans, the preset scoring threshold can be appropriately lowered, and then the IP address screening is performed until the requirement of the number of IP address scans is met.

[0107] Here, only performing full DoH server detection on IP addresses whose address scores are greater than the preset score threshold can reduce the number of IP addresses detected and further improve the efficiency of DoH server detection.

[0108] Specifically, for at least one target IP address whose address score is greater than a preset score threshold, perform a full DoH server detection through the following steps to determine the distribution information of the DoH servers:

[0109] e1: Establishing a HTTP security connection based on the target IP address, and screening candidate IP addresses that support the HTTP security protocol.

[0110] e2: Perform certificate detection for each candidate IP address, determine the SANs field of the candidate IP address, determine an access path based on the SANs field of the candidate IP address, and send query information based on the access path.

[0111] e3: Determine that among multiple candidate IP addresses, a candidate IP address that receives reply information for the query information and whose reply content corresponds to the query content of the query information exists in the DoH server.

[0112] In the embodiment of the present application, because the DoH service is based on the HTTPS protocol, it is necessary to establish a Hypertext Transfer Protocol Security connection through the filtered target IP address, and at the same time, filter out candidate IP addresses that support the Hypertext Transfer Protocol Security.

[0113] Furthermore, a certificate detection is performed for each candidate IP address to obtain the Subject Alternative Name (SANs) field in the SSL / TLS certificate of the candidate IP address. This field usually contains all domain name information supported by the service, and can include, for example, email addresses, IP addresses, URIs, DNS names, directory names, etc.

[0114] In one possible implementation, potential DoH services are identified based on the certificate's SANs field. After obtaining the domain name in the SANs field, a URL path is constructed using a prefix + domain name + suffix or IP + suffix format. This path is then accessed and responses collected. The prefix typically consists of the "doh" or "dns" fields, while the suffix typically includes fields such as "\dns-query," "\," and ",resolve," which are then concatenated in a combination.

[0115] In one possible implementation, for an IP address where a DoH server exists, it is generally possible to receive and reply to DNS query information. If a reply information is received, and the format of the reply information is correct, and the reply content of the reply information corresponds to the query content of the query information, it is determined that a DoH server exists for the candidate IP address.

[0116] Among them, the correspondence between the content of the reply information and the query content of the query information represents that the reply information correctly presents the content queried by the query information. For example, if the query information indicates to query a specific website, and the reply information displays a specific website link, it means that the content of the reply information corresponds to the query content of the query information.

[0117] In one possible implementation, in order to ensure the timeliness and accuracy of the DoH server distribution scoring model detection, it is necessary to update the DoH server distribution scoring model according to the preset time update frequency, based on the latest updated IP feature vector and the probability of occurrence of the DoH server corresponding to each updated IP feature vector.

[0118] Specifically, the detection method further includes:

[0119] f1: According to the preset time update frequency, based on the distribution information of the DoH server, determine the updated mapping relationship between the updated address segment information, geographic location information, autonomous system information and organization information and the probability of DoH server appearance.

[0120] f2: Based on the update mapping relationship, determine multiple sample update IP feature vectors and the probability of occurrence of the DoH server corresponding to each update IP feature vector.

[0121] f3: Based on the updated IP feature vectors and the probability of occurrence of DoH servers corresponding to each updated IP feature vector, update the DoH server distribution scoring model.

[0122] In an embodiment of the present application, due to the update of the distribution of DoH servers in different address segments, geographical locations, autonomous systems or organizations (the number of DoH servers increases or decreases), the probability of occurrence of DoH servers in the same address segment, geographical location, autonomous system or organization will also change accordingly, and the mapping relationship between the address segment information, geographical location information, autonomous system information and organization information and the probability of DoH server occurrence will also change. At this time, the mapping relationship in the DoH server distribution scoring model will no longer be accurate, and it needs to be updated and adjusted according to the updated mapping relationship between the updated address segment information, geographical location information, autonomous system information and organization information and the probability of DoH server occurrence, so as to ensure the timeliness and accuracy of the DoH server distribution scoring model detection.

[0123] Here, the process of updating the DoH server distribution scoring model through the updated mapping relationship between the updated address segment information, geographic location information, autonomous system information, and organization information and the probability of DoH server occurrence is consistent with the process of training the DoH server distribution scoring model, and will not be repeated here.

[0124] In a possible implementation, the preset time update frequency can be set according to actual needs or the update frequency of the DoH server, and is not specifically limited here.

[0125] The following will illustrate the detection process of the DoH server in the embodiment of the present application through specific examples.

[0126] See also Figure 2 , Figure 2 This is a schematic diagram of the entire detection process of the DoH server provided in the embodiment of the present application, as shown in FIG. Figure 2 As shown, first scan the active IP addresses of port 443; input the scanned IP addresses into the DoH server distribution scoring model, and determine the preset scoring threshold based on the actual network conditions; perform a full DoH server detection on the filtered target IP addresses, and further update the DoH server distribution scoring model based on the scan results.

[0127] See also Figure 3 , Figure 3 This is a schematic diagram of the DoH server distribution scoring model construction process provided in the embodiment of the present application, as shown in FIG. Figure 3 As shown, data is first collected and preprocessed, and then feature extraction is performed. A model is constructed based on the extracted feature vectors, and then the score is calculated through the constructed model. Finally, the model is optimized and updated.

[0128] See also Figure 4 , Figure 4A DoH server full detection process diagram provided by the embodiment of the present application is shown in Figure 4 As shown, an IP address is input, an HTTPS connection to the IP address is attempted, and an HTTPS certificate is obtained; a SANs field in the HTTPS certificate is obtained, a prefix and a suffix of the DoH server are spliced according to the certificate SANs field, and a domain name for detection is obtained, a judgment result of whether the reply result is a normal DNS message is obtained, and then a judgment result of whether the IP address exists the DoH server is obtained.

[0129] Exemplarily, the IP address is scored and screened by the DoH server distribution scoring model, about 19000 DoH servers are found by detecting only 430,000 nodes, and 22000 servers are found by scanning 370 million addresses using the traditional full detection method, which significantly improves the detection efficiency of the DoH server.

[0130] The detection method of the DoH server provided by the embodiment of the present application, by scanning the target network port, obtains at least one IP address; for each IP address, based on the address segment information, the geographic location information, the autonomous system information and the organization information to which the IP address belongs, the IP feature vector of the IP address is determined; the determined IP feature vectors are input into the pre-trained DoH server distribution scoring model, and the address scores of the IP addresses are output; for at least one target IP address with an address score greater than a preset score threshold, full DoH server detection is performed to determine the distribution information of the DoH server. In this way, the IP address is scored by the pre-trained DoH server distribution scoring model, and the target IP address with an address score greater than the preset score threshold is screened out for full DoH server detection, reducing the number of IP addresses that need to be screened by full query, and further improving the detection efficiency of the DoH server.

[0131] Based on the same inventive concept, the embodiment of the present application also provides a DoH server detection device corresponding to the DoH server detection method. Since the principle of solving the problem in the device of the embodiment of the present application is similar to the above-mentioned DoH server detection method of the embodiment of the present application, the implementation of the device can be referred to the implementation of the method, and the repeated parts will not be described here.

[0132] Please refer to Figure 5 、 Figure 6 , Figure 5 A structure diagram of a DoH server detection device provided by the embodiment of the present application, Figure 6 A structure diagram of a DoH server detection device provided by the embodiment of the present application. As shown in Figure 5 The detection device 500 includes:

[0133] The address obtaining module 510 is configured to obtain at least one IP address by scanning a target network port.

[0134] The feature vector determining module 520 is configured to determine, for each IP address, an IP feature vector of the IP address based on address segment information, geographical location information, autonomous system information, and organization information to which the IP address belongs.

[0135] The address score determining module 530 is configured to input each determined IP feature vector into a pre-trained DoH server distribution scoring model, and output an address score of each IP address; wherein the address score of each IP address is positively correlated with the occurrence probability of a DoH server on the IP address.

[0136] The distribution information determining module 540 is configured to, for at least one target IP address with an address score greater than a preset score threshold, perform full-amount DoH server detection to determine distribution information of DoH servers.

[0137] In a possible implementation, for each IP feature vector, the address score determining module 530 is configured to determine an address score of each IP address by the following steps:

[0138] inputting the IP feature vector into the DoH server distribution scoring model, determining a target DoH server occurrence probability corresponding to the IP feature vector based on address segment information, geographical location information, autonomous system information, and organization information in the IP feature vector, and combining a mapping relationship between the address segment information, the geographical location information, the autonomous system information, and the organization information and the DoH server occurrence probability;

[0139] outputting the address score of the IP address based on the target DoH server occurrence probability.

[0140] In a possible implementation, for at least one target IP address with an address score greater than a preset score threshold, the distribution information determining module 540 is configured to perform full-amount DoH server detection to determine distribution information of DoH servers by the following steps:

[0141] establishing a hypertext transfer protocol secure connection based on the target IP address, and screening out a candidate IP address supporting the hypertext transfer protocol secure;

[0142] performing certificate detection for each candidate IP address, determining a SANs field of the candidate IP address, determining an access path based on the SANs field of the candidate IP address, and sending query information based on the access path;

[0143] Determine that among multiple candidate IP addresses, a candidate IP address that receives a reply message for the query information and whose reply content corresponds to the query content of the query information exists in the DoH server.

[0144] In one possible implementation, Figure 6 As shown, the detection device 500 further includes a model training module 550, which is configured to train the DoH server distribution scoring model through the following steps:

[0145] Obtain multiple sample IP addresses scanned, as well as the historical address segment information, historical geographic location information, historical autonomous system information, and historical organization information corresponding to each sample IP address;

[0146] For each sample IP address, perform feature extraction and encoding conversion based on the historical address segment information, historical geographic location information, historical autonomous system information, and historical organization information corresponding to the sample IP address to determine the sample IP feature vector of the sample IP address;

[0147] Calculate the probability of DoH server occurrence corresponding to each feature of each sample IP feature vector, and determine the feature weight corresponding to each feature in each sample IP feature vector;

[0148] The pre-built neural network model is trained with the sample IP feature vector and the corresponding DoH server occurrence probability as training targets to obtain the DoH server distribution scoring model.

[0149] In one possible implementation, when the model training module 550 is used to perform feature extraction and encoding conversion for each sample IP address based on historical address segment information, historical geographic location information, historical autonomous system information, and historical organization information corresponding to the sample IP address to determine a sample IP feature vector for the sample IP address, the model training module 550 is used to:

[0150] For each sample IP address, determine the address segment category to which the sample IP address belongs based on the historical address segment information;

[0151] Based on the historical geographic location information, determine the target location to which the sample IP address belongs, encode the target location, and determine a location encoding feature;

[0152] Encoding the autonomous systems contained in the historical autonomous system information into system encoding features, and converting the historical organization information into organization numerical features;

[0153] Based on the address segment classification, the location coding feature, the system coding feature, and the organization numerical feature, a sample IP feature vector of the sample IP address is determined.

[0154] In a possible implementation, as shown in Figure 6 The detection apparatus 500 further includes a model updating module 560, configured to:

[0155] According to a preset time updating frequency, based on the distribution information of the DoH server, an updated address segment information, geographical location information, autonomous system information, and organization information, and an updated mapping relationship between the DoH server occurrence probability are determined.

[0156] Based on the updated mapping relationship, a plurality of sample updated IP feature vectors and a DoH server occurrence probability corresponding to each updated IP feature vector are determined.

[0157] Based on the updated IP feature vector and the DoH server occurrence probability corresponding to each updated IP feature vector, the DoH server distribution scoring model is updated.

[0158] In a possible implementation, as shown in Figure 6 The detection apparatus 500 further includes an address screening module 570, configured to:

[0159] If there is no historical detection information of the IP address at present, full DoH server detection is performed on each IP address to determine the distribution information of the DoH server.

[0160] The detection apparatus of the DoH server provided by the embodiments of the present application acquires at least one IP address through scanning of a target network port; for each IP address, an IP feature vector of the IP address is determined based on address segment information, geographical location information, autonomous system information, and organization information to which the IP address belongs; each determined IP feature vector is input into a pre-trained DoH server distribution scoring model, and address scores of each IP address are output; for at least one target IP address with an address score greater than a preset score threshold, full DoH server detection is performed to determine the distribution information of the DoH server. In this way, the IP addresses are scored by the pre-trained DoH server distribution scoring model, and the target IP addresses with an address score greater than the preset score threshold are screened out for full DoH server detection, thereby reducing the number of IP addresses that need to be screened for full query, and further improving the detection efficiency of the DoH server.

[0161] Please refer to Figure 7 , Figure 7This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 7 As shown in FIG, the electronic device 700 includes a processor 710 , a memory 720 and a bus 730 .

[0162] The memory 720 stores machine-readable instructions executable by the processor 710. When the electronic device 700 is running, the processor 710 communicates with the memory 720 via the bus 730. When the machine-readable instructions are executed by the processor 710, the above-mentioned Figure 1 The steps of the DoH server detection method in the method embodiment shown, the specific implementation method can be found in the method embodiment, and will not be repeated here.

[0163] The embodiment of the present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the computer program can execute the above-mentioned Figure 1 The steps of the DoH server detection method in the method embodiment shown, the specific implementation method can be found in the method embodiment, and will not be repeated here.

[0164] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0165] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. There may be other division methods in actual implementation. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed may be through some communication interface, indirect coupling or communication connection of devices or units, which may be electrical, mechanical or other forms.

[0166] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0167] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0168] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0169] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solutions of the present application, rather than to limit them. The scope of protection of the present application is not limited thereto. Although the present application has been described in detail with reference to the above-mentioned embodiments, those skilled in the art should understand that any person skilled in the art can modify or easily conceive of changes to the technical solutions described in the above-mentioned embodiments within the technical scope disclosed in the present application, or perform equivalent replacements for some of the technical features thereof. These modifications, changes, or replacements do not deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A detection method for a DoH server, characterized in that: The detection method comprises: Obtain at least one IP address by scanning the target network port; For each IP address, determine the IP feature vector of the IP address based on the address segment information, geographic location information, autonomous system information, and organization information of the IP address; Input each determined IP feature vector into a pre-trained DoH server distribution scoring model to output the address score of each IP address; the address score of each IP address is positively correlated with the probability of the DoH server appearing at that IP address; For at least one target IP address whose address score is greater than the preset score threshold, perform a full DoH server detection to determine the distribution information of the DoH server; The DoH server distribution scoring model is trained by the following steps: Obtain multiple sample IP addresses scanned, as well as the historical address segment information, historical geographic location information, historical autonomous system information, and historical organization information corresponding to each sample IP address; For each sample IP address, perform feature extraction and encoding conversion based on the historical address segment information, historical geographic location information, historical autonomous system information, and historical organization information corresponding to the sample IP address to determine the sample IP feature vector of the sample IP address; Calculate the probability of DoH server occurrence corresponding to each feature of each sample IP feature vector, and determine the feature weight corresponding to each feature in each sample IP feature vector; The pre-built neural network model is trained with the sample IP feature vector and the corresponding DoH server occurrence probability as training targets to obtain the DoH server distribution scoring model.

2. The detection method according to claim 1, wherein For each IP feature vector, the address score of each IP address is determined through the following steps: The IP feature vector is input into the DoH server distribution scoring model, and based on the address segment information, geographic location information, autonomous system information, and organization information in the IP feature vector, the probability of occurrence of the target DoH server corresponding to the IP feature vector is determined in combination with the mapping relationship between the address segment information, geographic location information, autonomous system information, and organization information and the probability of occurrence of the DoH server; Based on the probability of occurrence of the target DoH server, the address score of the IP address is output.

3. The detection method according to claim 1, wherein For at least one target IP address with an address score greater than the preset score threshold, perform a full DoH server detection to determine the distribution information of the DoH servers: Establishing a Hypertext Transfer Protocol Security (HTTP) connection based on the target IP address and screening candidate IP addresses that support the HTTP protocol; Perform certificate detection on each candidate IP address, determine the SANs field of the candidate IP address, determine an access path based on the SANs field of the candidate IP address, and send query information based on the access path; Determine that among multiple candidate IP addresses, a candidate IP address that receives a reply message for the query information and whose reply content corresponds to the query content of the query information exists in the DoH server.

4. The detection method according to claim 1, wherein For each sample IP address, feature extraction and encoding conversion are performed based on the historical address segment information, historical geographic location information, historical autonomous system information, and historical organization information corresponding to the sample IP address to determine the sample IP feature vector of the sample IP address, including: For each sample IP address, determine the address segment category to which the sample IP address belongs based on the historical address segment information; Based on the historical geographic location information, determine the target location to which the sample IP address belongs, encode the target location, and determine a location encoding feature; encoding the autonomous systems contained in the historical autonomous system information into system coding features, and converting the historical organization information into organization numerical features; Based on the address segment classification, the location coding feature, the system coding feature, and the organization numerical feature, a sample IP feature vector of the sample IP address is determined.

5. The detection method according to claim 1, wherein The detection method further comprises: Determine, at a preset time update frequency, an updated mapping relationship between the updated address segment information, geographic location information, autonomous system information, and organization information and the probability of DoH server appearance based on the distribution information of the DoH server; Determine, based on the update mapping relationship, multiple sample update IP feature vectors and the probability of occurrence of the DoH server corresponding to each update IP feature vector; Based on the updated IP feature vectors and the probability of occurrence of DoH servers corresponding to each updated IP feature vector, the DoH server distribution scoring model is updated.

6. The detection method according to claim 1, characterized in that After obtaining at least one IP address by scanning the target network port, the detection method further includes: If there is no historical detection information for the IP address, a complete DoH server detection is performed on each IP address to determine the distribution information of the DoH server.

7. A detection device for a DoH server, characterized in that: The detection device comprises: An address acquisition module is used to obtain at least one IP address by scanning a target network port; A feature vector determination module is used to determine, for each IP address, an IP feature vector of the IP address based on the address segment information, geographic location information, autonomous system information, and organization information to which the IP address belongs; An address score determination module, which is used to input the determined IP feature vectors into a pre-trained DoH server distribution scoring model and output the address score of each IP address; wherein the address score of each IP address is positively correlated with the probability of the DoH server appearing at the IP address; A distribution information determination module is configured to perform a full DoH server detection for at least one target IP address whose address score is greater than a preset score threshold, and determine the distribution information of the DoH server; The detection device further includes a model training module, which is configured to train the DoH server distribution scoring model through the following steps: Obtain multiple sample IP addresses scanned, as well as the historical address segment information, historical geographic location information, historical autonomous system information, and historical organization information corresponding to each sample IP address; For each sample IP address, perform feature extraction and encoding conversion based on the historical address segment information, historical geographic location information, historical autonomous system information, and historical organization information corresponding to the sample IP address to determine the sample IP feature vector of the sample IP address; Calculate the probability of DoH server occurrence corresponding to each feature of each sample IP feature vector, and determine the feature weight corresponding to each feature in each sample IP feature vector; The pre-built neural network model is trained with the sample IP feature vector and the corresponding DoH server occurrence probability as training targets to obtain the DoH server distribution scoring model.

8. An electronic device, characterized in that: include: A processor, a storage medium and a bus, wherein the storage medium stores machine-readable instructions executable by the processor. When the electronic device is running, the processor and the storage medium communicate through the bus, and the processor executes the machine-readable instructions to perform the steps of the DoH server detection method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the DoH server detection method according to any one of claims 1 to 6 are executed.

Images