Method and device for dividing recursive server addresses

Abstract

The invention discloses a recursive server address division method and device, and the method comprises the steps: carrying out the first clustering and first labeling of each recursive server IP address according to the number of network segments of a plurality of recursive server IP addresses; according to the query behavior characteristics of the recursive server IP addresses, performing second clustering and second labeling on each recursive server IP address; according to domain name features of the recursive server IP addresses, performing third clustering and third labeling on each recursive server IP address with the same second label; and judging that the IP addresses of the recursive servers with the same three labels belong to the same recursive address pool. Therefore, the multiple recursive server IP addresses are clustered by adopting a multi-level classification clustering method, the multiple recursive server IP addresses belonging to the same recursive address pool can be effectively found, and the problems that comprehensive views cannot be provided, and blind areas occur in management and monitoring are solved.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a method and device for dividing recursive server addresses. Background Art

[0002] In the current Internet environment, the Domain Name System (DNS) plays a vital role in converting human-readable domain names into computer-readable IP addresses. Among them, the DNS server architecture has a complex structure, mainly including service-side IP and recursive-side IP. In particular, a service-side IP address may correspond to multiple recursive-side IP addresses, which makes the recursive-side IP address form a structure of multiple IP address pools, that is, the recursive-side IP serving the same service-side IP is called a recursive-side address pool. Therefore, in order to supervise network management and DNS security operation, it is necessary to identify whether multiple recursive-side IPs belong to the same address pool.

[0003] In the existing technology, a query request is sent to a DNS server, and then the recursive server address of the service side IP is analyzed according to the query result returned by the DNS server, and finally the recursive server addresses belonging to the same service side IP are classified into a recursive server pool.

[0004] However, the existing technology needs to send a large number of query requests to the DNS server, which is not only time-consuming and labor-intensive, but may also cause additional burden on the DNS server. In addition, the existing technology can often only reveal the IP addresses of some recursive servers and cannot provide a comprehensive view, resulting in blind spots in management and monitoring, which may cause these blind spots to be maliciously attacked, thereby causing security risks. Summary of the invention

[0005] Based on the above-mentioned deficiencies of the prior art, the present application provides a method and device for dividing recursive server addresses to solve the problem that the prior art can only reveal the IP addresses of some recursive servers and cannot provide a comprehensive view, resulting in blind spots in management and monitoring.

[0006] In order to achieve the above objectives, this application provides the following technical solutions:

[0007] The first aspect of the present application provides a method for dividing a recursive server address, comprising:

[0008] Extracting query information of multiple recursive servers from the authoritative side log; wherein the query information of one recursive server at least includes the recursive server IP address and the query behavior characteristics and domain name characteristics of the recursive server IP address;

[0009] Clustering the recursive server IP addresses corresponding to each of the recursive servers according to the number of network segment bits of each of the recursive server IP addresses to obtain a first cluster set corresponding to each of the recursive server IP addresses;

[0010] Labeling the first cluster set corresponding to each of the recursive server IP addresses to obtain a first cluster label corresponding to each of the recursive server IP addresses;

[0011] Inputting the query behavior characteristics of each recursive server IP address into a clustering algorithm for unsupervised clustering to obtain a second clustering set of each recursive server IP address;

[0012] Labeling the second cluster set of each recursive server IP address to obtain a second cluster label corresponding to each recursive server IP address;

[0013] Marking each of the recursive server IP addresses having the same second clustering label as a target recursive server IP address, and performing semi-supervised clustering on each of the target recursive server IP addresses according to the domain name features of each of the target recursive server IP addresses to obtain a third clustering set corresponding to each of the target recursive server IP addresses;

[0014] Labeling the third cluster set corresponding to each of the target recursive server IP addresses to obtain a third cluster label corresponding to each of the target recursive server IP addresses;

[0015] A plurality of recursive server IP addresses having three consistent clustering labels are searched from all the recursive server IP addresses, and the plurality of recursive server IP addresses having three consistent clustering labels are assigned to the same recursive address pool.

[0016] Optionally, in the above-mentioned method for dividing the recursive server addresses, the step of inputting the query behavior feature of each of the recursive server IP addresses into a clustering algorithm for unsupervised clustering to obtain a second clustering set of each of the recursive server IP addresses includes:

[0017] Obtaining all recursive server IP addresses, and integrating all the recursive server IP addresses to obtain a data set;

[0018] Randomly select K recursive server IP addresses from the data set as K initial clustering centers;

[0019] For each of the recursive server IP addresses in the data set, respectively, calculate the distance between the query behavior feature of the recursive server IP address and each of the initial cluster centers, and assign the recursive server IP address to the initial cluster center corresponding to the minimum distance to obtain the target cluster center;

[0020] For all the target cluster centers, respectively, the average value of the target cluster centers is calculated, and the average value is used as the new cluster center;

[0021] Iterate each of the new cluster centers and record the current number of iterations;

[0022] Determine whether the current number of iterations meets a preset number of iterations;

[0023] If the current number of iterations does not meet the preset number of iterations, each of the new cluster centers is used as the initial cluster center, and the process of returning to the step of calculating the distance between the query behavior characteristics of the recursive server IP address and each of the initial cluster centers for each of the recursive server IP addresses in the data set, and assigning the recursive server IP address to the initial cluster center corresponding to the minimum distance to obtain the target cluster center;

[0024] If the current number of iterations meets the preset number of iterations, each of the new cluster centers is used as a second clustering set for each of the recursive server IP addresses.

[0025] Optionally, in the above-mentioned method for dividing the recursive server addresses, the semi-supervised clustering is performed on each target recursive server IP address according to the domain name feature of each target recursive server IP address to obtain a third cluster set corresponding to each target recursive server IP address, including:

[0026] Randomly select a target recursive server IP address from all target recursive server IP addresses, and use the selected target recursive server IP address as the core recursive server IP address;

[0027] Based on the domain name feature of the core recursive server IP address, determining whether there is at least one target recursive server IP address within the radius of the core recursive server IP address;

[0028] If there is at least one target recursive server IP address within the radius of the core recursive server IP address, clustering all target recursive server IP addresses within the radius of the core recursive server IP address to obtain a third cluster set corresponding to the core recursive server IP address;

[0029] Select any one target recursive server IP address except the core recursive server IP address from all target recursive server IP addresses, and use the selected target recursive server IP address as the next core recursive server IP address, return to execute the domain name feature based on the core recursive server IP address, and determine whether there is at least one target recursive server IP address within the radius of the core recursive server IP address, until all target recursive server IP addresses are selected.

[0030] Optionally, in the above-mentioned method for dividing the recursive server addresses, the method for obtaining the radius range of the core recursive server IP address includes:

[0031] Sending multiple DNS request messages to the service-side recursive server through the client, and the service-side recursive server forwarding each of the DNS request messages to the recursive service pool;

[0032] Receiving each of the DNS request messages through the recursive service pool, and generating a query instruction corresponding to each of the DNS request messages based on each of the DNS request messages;

[0033] Receive a query instruction corresponding to each of the DNS request messages sent by the recursive service pool, and obtain a source IP address corresponding to each of the DNS request messages according to the query instruction corresponding to the DNS request message;

[0034] Determine whether there is an identical domain name in all the source IP addresses;

[0035] If there is a same domain name in all the source IP addresses, cluster each source IP address corresponding to the same domain name;

[0036] The clustering distance between each source IP address after clustering is set as a preset threshold, and the preset threshold is used as the radius range of the core recursive server IP address.

[0037] Optionally, in the above-mentioned method for dividing recursive server addresses, the step of obtaining domain name features of recursive server IP addresses of multiple recursive servers includes:

[0038] Create a hash counting table and initialize the value of each cell in the hash counting table;

[0039] Obtain all query records from the database; wherein the query records at least include a domain name of a recursive server IP address of a recursive server;

[0040] Calculate the hash value of each domain name by using a hash function, and store the hash value of each domain name in a cell included in the hash counting table;

[0041] Traversing all the query records, and adding 1 to the value of the cell corresponding to the domain name in the hash counting table each time the domain name is traversed;

[0042] After traversing all the query records, a query content vector of the domain name is generated based on the value of the domain name in the hash counting table, and the query content vector is used as the domain name feature of the recursive server IP address corresponding to the domain name.

[0043] A second aspect of the present application provides a device for dividing a recursive server address, including:

[0044] An information extraction unit, used to extract query information of multiple recursive servers from the authoritative side log; wherein the query information of one recursive server at least includes the recursive server IP address and the query behavior characteristics and domain name characteristics of the recursive server IP address;

[0045] A first clustering unit, configured to cluster the recursive server IP addresses corresponding to each of the recursive servers according to the number of network segment bits of each of the recursive server IP addresses, to obtain a first cluster set corresponding to each of the recursive server IP addresses;

[0046] A first labeling unit, configured to label a first cluster set corresponding to each of the recursive server IP addresses to obtain a first clustering label corresponding to each of the recursive server IP addresses;

[0047] A second clustering unit, used for inputting the query behavior feature of each recursive server IP address into a clustering algorithm for unsupervised clustering to obtain a second clustering set of each recursive server IP address;

[0048] A second labeling unit, configured to label the second clustering set of each recursive server IP address to obtain a second clustering label corresponding to each recursive server IP address;

[0049] A third clustering unit is used to mark each of the recursive server IP addresses having the same second clustering label as a target recursive server IP address, and perform semi-supervised clustering on each target recursive server IP address according to a domain name feature of each target recursive server IP address to obtain a third cluster set corresponding to each target recursive server IP address;

[0050] A third labeling unit, configured to label the third cluster set corresponding to each of the target recursive server IP addresses, to obtain a third clustering label corresponding to each of the target recursive server IP addresses;

[0051] The attribution unit is used to search for multiple recursive server IP addresses with the same three clustering labels from all the recursive server IP addresses, and attribute the multiple recursive server IP addresses with the same three clustering labels to the same recursive address pool.

[0052] Optionally, in the above-mentioned device for dividing recursive server addresses, the second clustering unit includes:

[0053] An integration unit, used to obtain all recursive server IP addresses and integrate all the recursive server IP addresses to obtain a data set;

[0054] A selection unit, used for randomly selecting K IP addresses of the recursive servers from the data set as K initial clustering centers;

[0055] A first calculation unit is used to calculate the distance between the query behavior feature of the recursive server IP address and each of the initial cluster centers for each of the recursive server IP addresses in the data set, and assign the recursive server IP address to the initial cluster center corresponding to the minimum distance to obtain a target cluster center;

[0056] A second calculation unit, used for calculating the average value of the target cluster centers for all the target cluster centers respectively, and taking the average value as a new cluster center;

[0057] An iteration unit, used for iterating each of the new cluster centers and recording the current iteration number;

[0058] A number determination unit, used to determine whether the current number of iterations meets a preset number of iterations;

[0059] If the current number of iterations does not meet the preset number of iterations, each of the new cluster centers is used as the initial cluster center, and the process of returning to the step of calculating the distance between the query behavior characteristics of the recursive server IP address and each of the initial cluster centers for each of the recursive server IP addresses in the data set, and assigning the recursive server IP address to the initial cluster center corresponding to the minimum distance to obtain the target cluster center;

[0060] As a unit, it is used to use each of the new cluster centers as the second clustering set of each of the recursive server IP addresses if the current number of iterations meets the preset number of iterations.

[0061] Optionally, in the above-mentioned device for dividing recursive server addresses, the third clustering unit includes:

[0062] A selection unit, used to select any one target recursive server IP address from all target recursive server IP addresses, and use the selected target recursive server IP address as a core recursive server IP address;

[0063] A judging unit, configured to judge whether there is at least one target recursive server IP address within a radius of the core recursive server IP address based on a domain name feature of the core recursive server IP address;

[0064] a clustering unit, configured to cluster all target recursive server IP addresses within the radius of the core recursive server IP address to obtain a third cluster set corresponding to the core recursive server IP address if there is at least one target recursive server IP address within the radius of the core recursive server IP address;

[0065] The return execution unit is used to select any target recursive server IP address other than the core recursive server IP address from all target recursive server IP addresses, and use the selected target recursive server IP address as the next core recursive server IP address, return to execute the domain name feature based on the core recursive server IP address, and determine whether there is at least one target recursive server IP address within the radius of the core recursive server IP address, until all target recursive server IP addresses are selected.

[0066] Optionally, in the above-mentioned recursive server address division device, it also includes:

[0067] A sending unit, configured to send multiple DNS request messages to a service-side recursive server through a client, and the service-side recursive server forwards each of the DNS request messages to a recursive service pool;

[0068] A generating unit, configured to receive each of the DNS request messages through the recursive service pool, and generate a query instruction corresponding to each of the DNS request messages based on each of the DNS request messages;

[0069] An address acquisition unit, configured to receive a query instruction corresponding to each of the DNS request messages sent by the recursive service pool, and acquire a source IP address corresponding to the DNS request message according to the query instruction corresponding to the DNS request message for each of the DNS request messages;

[0070] A domain name determination unit, used to determine whether there is an identical domain name in all the source IP addresses;

[0071] If there is a same domain name in all the source IP addresses, cluster each source IP address corresponding to the same domain name;

[0072] The setting unit is used to set the clustering distance between each source IP address after clustering as a preset threshold, and use the preset threshold as the radius range of the core recursive server IP address.

[0073] Optionally, in the above-mentioned recursive server address division device, it also includes:

[0074] A creation unit, used to create a hash counting table and initialize the value of each cell in the hash counting table;

[0075] A record acquisition unit, used to acquire all query records from a database; wherein the query records include at least a domain name of a recursive server IP address of a recursive server;

[0076] a third calculation unit, configured to calculate a hash value of each of the domain names by using a hash function, and store the hash value of each of the domain names in a cell included in the hash counting table;

[0077] A traversal unit, used for traversing all the query records, and adding 1 to the value of the cell corresponding to the domain name in the hash counting table each time the domain name is traversed;

[0078] A vector generating unit is used to generate a query content vector of the domain name based on the value of the domain name in the hash counting table after traversing all the query records, and use the query content vector as the domain name feature of the recursive server IP address corresponding to the domain name.

[0079] The present application provides a method for dividing recursive server addresses, which extracts query information of multiple recursive servers from an authoritative side log, wherein the query information of a recursive server includes at least the recursive server IP address and the query behavior characteristics and domain name characteristics of the recursive server IP address; secondly, clustering the recursive server IP addresses corresponding to each recursive server according to the network segment bits of each recursive server IP address to obtain a first clustering set corresponding to each recursive server IP address; then labeling the first clustering set corresponding to each recursive server IP address to obtain a first clustering label corresponding to each recursive server IP address; then inputting the query behavior characteristics of each recursive server IP address into a clustering algorithm for unsupervised clustering to obtain a second clustering set for each recursive server IP address; and then clustering each recursive server IP address again. The second clustering set of the recursive server IP address is labeled to obtain the second clustering label corresponding to each recursive server IP address, and then each recursive server IP address with the same second clustering label is marked as the target recursive server IP address, and each target recursive server IP address is semi-supervised clustered according to the domain name characteristics of each target recursive server IP address to obtain the third clustering set corresponding to each target recursive server IP address, and then the third clustering set corresponding to each target recursive server IP address is labeled to obtain the third clustering label corresponding to each target recursive server IP address, and finally multiple recursive server IP addresses with the same three clustering labels are found from all recursive server IP addresses, and the multiple recursive server IP addresses with the same three clustering labels are attributed to the same recursive address pool. Therefore, based on the query behavior characteristics and domain name characteristics of the recursive server IP address and the recursive server IP address, a multi-level classification clustering method is performed, which can effectively find multiple recursive service IPs belonging to the same recursive server pool, thereby providing a comprehensive view and solving the problem of blind spots in management and monitoring. BRIEF DESCRIPTION OF THE DRAWINGS

[0080] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0081] Figure 1 A flowchart of a method for dividing recursive server addresses provided in an embodiment of the present application;

[0082] Figure 2 A flowchart of a method for obtaining domain name features provided in an embodiment of the present application;

[0083] Figure 3 A schematic diagram of a process of an unsupervised clustering method provided in an embodiment of the present application;

[0084] Figure 4 A schematic diagram of a process flow of a semi-supervised clustering method provided in an embodiment of the present application;

[0085] Figure 5 A flowchart of a method for obtaining a radius range of a core recursive server IP address provided in an embodiment of the present application;

[0086] Figure 6 A schematic diagram of the structure of a method for obtaining semi-supervised constraint conditions provided in an embodiment of the present application;

[0087] Figure 7 A schematic diagram of the structure of a recursive server address division device provided in another embodiment of the present application. DETAILED DESCRIPTION

[0088] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0089] In this application, relational terms such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0090] The present application embodiment provides a method for dividing recursive server addresses, such as Figure 1 As shown, the specific steps include:

[0091] S101: extract query information of multiple recursive servers from the authoritative side log.

[0092] Since the authoritative side log contains a large number of recursive server IP addresses, and these recursive server IP addresses may have an address pool structure, that is, these recursive server IP addresses may have addresses belonging to the same address pool, it is necessary to extract the query information of multiple recursive servers from the authoritative side log. Among them, the query information of a recursive server at least includes the recursive server IP address and the query behavior characteristics and domain name characteristics of the recursive server IP address.

[0093] Optionally, all query information within a preset time period may be mentioned in the authoritative side log, and then the fields extracted from the query information are: <recursive server IP address, query occurrence time, query behavior characteristics, domain name characteristics>.

[0094] Optionally, the preset time period may be within 24 hours, or other time thresholds, which may be specifically set according to requirements.

[0095] Optionally, the embodiment of the present application provides a method for obtaining domain name features, such as Figure 2 As shown, the following steps are included:

[0096] S201. Create a hash counting table and initialize the value of each cell in the hash counting table.

[0097] It can be understood that the domain name feature is all the domain names and quantities queried by the recursive server IP address. The principle of the domain name feature is that the requests generated by each server address in the same recursive server pool are similar, and the recursive server IP address involves a large number of query domain names. If all records and counts are performed, the feature dimension may be too high. Therefore, the embodiment of the present application adopts a hash table method to generate a feature vector of a fixed length. Therefore, it is necessary to establish a hash count table with a value size of 1000 and initialize the value of each cell in the hash count table. This hash count table will be used to store the query count of each cell.

[0098] S202: Obtain all query records from the database.

[0099] Specifically, after successfully creating the hash counting table, the number of all domain names queried by the recursive server IP address needs to be recorded, so all query records can be obtained from the database first. The query record includes at least one domain name of the recursive server IP address of the recursive server.

[0100] Optionally, the embodiment of the present application is not limited to obtaining all query records from the database, and any carrier that can store information can store the query records in advance and then obtain them from the stored carrier.

[0101] S203. Calculate the hash value of each domain name using a hash function, and store the hash value of each domain name in a cell included in the hash count table.

[0102] It can be understood that after obtaining all the domain names queried by the recursive server IP address, the hash function is used to calculate the hash value of each domain name and map the hash value of each domain name to the range of 0 to 999, thereby avoiding the feature dimension being too high. Finally, the hash value of each domain name is stored in the cell contained in the hash counting table to achieve the purpose of hash counting.

[0103] The hash function is: hash_value = hash(query)% 1000, where query is the domain name.

[0104] S204, traverse all query records, and each time a domain name is traversed, add 1 to the value of the cell corresponding to the domain name in the hash counting table.

[0105] Specifically, after calculating the basic hash value of each domain name, we can start to count the number of each domain name. Therefore, all query records are traversed first. Whenever any domain name is traversed, the value of the cell corresponding to the domain name in the hash counting table needs to be increased by 1 until the domain names in all query records are traversed. Only then can the feature vector of the domain name be accurately obtained.

[0106] S205. After traversing all query records, a query content vector of the domain name is generated based on the value of the domain name in the hash count table, and the query content vector is used as the domain name feature of the recursive server IP address corresponding to the domain name.

[0107] It can be understood that after traversing all query records, the numerical value corresponding to each unit in the hash count table can form a query content vector, and at this time, the query content vector can be used as the domain name feature of the domain name.

[0108] S102: Cluster the recursive server IP addresses corresponding to each recursive server according to the number of network segment bits of each recursive server IP address to obtain a first cluster set corresponding to each recursive server IP address.

[0109] Specifically, in order to determine whether multiple IP addresses belong to the same address pool, the embodiment of the present application adopts a secondary clustering method to discover the recursive side server pool. Therefore, after obtaining the recursive server IP address, the first clustering can be started. Therefore, in the first clustering, the recursive server IP addresses with a network segment of 16 bits are clustered into one category. Of course, other network segment bit thresholds can also be used, which can be set according to needs. When the clustering is completed, the first clustering set of the recursive server IP addresses can be obtained.

[0110] For example, if there are multiple recursive servers with IP addresses of 1.1.1.1, 1.1.1.2, and 9.9.9.9, they will be divided into two categories based on the IP address information. Category 1 includes 1.1.1.1 and 1.1.1.2, and category 2 includes 9.9.9.9.

[0111] S103: Label the first cluster set corresponding to each recursive server IP address to obtain a first cluster label corresponding to each recursive server IP address.

[0112] Specifically, after obtaining the clustering result of each recursive server IP address, a tag Tag_1 can be assigned to each recursive server IP address through the clustering result, that is, the recursive server IP addresses with the same clustering result have the same clustering tag, and the address pool can be determined based on the same clustering tag later.

[0113] S104: Input the query behavior feature of each recursive server IP address into a clustering algorithm for unsupervised clustering to obtain a second clustering set of each recursive server IP address.

[0114] It can be understood that after the first clustering is completed, the recursive server IP addresses can be clustered for the second time. Therefore, in the second clustering, the query behavior features shown in Table 1 can be used, and then the K-means algorithm is used to perform unsupervised large-scale clustering on each recursive server IP address to form k different types of second clustering sets.

[0115] Table 1

[0116] Query behavior characteristics Query Request Quantity-A Total query requests Query Request Quantity-NS Maximum total number of queries per hour Query request quantity - ANY Repeat query times Query request quantity-TXT

[0117] It should be noted that the query behavior characteristics shown in Table 1 are only used for illustration and can be specifically set according to requirements.

[0118] Optionally, in another embodiment of the present application, a specific implementation of step S104 is as follows: Figure 3 As shown, the following steps are included:

[0119] S301, obtaining all recursive server IP addresses, and integrating all recursive server IP addresses to obtain a data set.

[0120] Specifically, in order to cluster all recursive server IP addresses using the k-means clustering algorithm, it is necessary to first create a data set, so optionally, all recursive server IP addresses can be integrated using logical code. The specific logical code expression is:

[0121]

[0122] print(df_recursive_servers).

[0123] S302: Randomly select K recursive server IP addresses from the data set as K initial clustering centers.

[0124] Specifically, to randomly select K recursive server IP addresses from the data set as the initial clustering centers, you can use the random module or numpy library in Python. For example, the sample code is:

[0125] pythonCopy Code

[0126] importpandas as pdimportnumpy as np

[0127] #Assume that there is already a data set containing the recursive server IP addresses

[0128] recursive_servers=[

[0129] '192.168.1.1',

[0130] '192.168.1.2',

[0131] '10.0.0.1',

[0132] '172.16.0.1',

[0133] '192.168.1.3',

[0134] '10.0.0.2',

[0135] '172.16.0.2' ]

[0137] #Create a data frame

[0138] df_recursive_servers=pd.DataFrame(recursive_servers columns=['ip_address'])

[0139] #Set the number of cluster centers K to be selected

[0140] K=5

[0141] #Randomly select K initial cluster centers

[0142] initial_centers=df_recursive_servers.sample(n=K,random_state=1)

[0143] #Output the selected initial cluster center print("Initial cluster center:")print(initial_centers).

[0144] S303, for each recursive server IP address in the data set, calculate the distance between the query behavior feature of the recursive server IP address and each initial cluster center, and assign the recursive server IP address to the initial cluster center corresponding to the minimum distance to obtain the target cluster center.

[0145] It is understandable that after selecting K initial clustering centers, the recursive server IP addresses need to be distanced based on the Euclidean distance of the eight-dimensional features. Therefore, based on each recursive server IP address in the data set, that is, the data point, the distance between the query behavior characteristics of the data point and each initial clustering center is calculated, and then the recursive server IP address needs to be assigned to the initial clustering center corresponding to the minimum distance, so as to not only identify and manage similar query behaviors, but also provide a basis for subsequent clustering analysis.

[0146] S304: Calculate the average value of all target cluster centers respectively, and use the average value as the new cluster center.

[0147] Specifically, in order to obtain a more representative cluster center so that the clustering result can better reflect the overall characteristics of the cluster, the average value of the target cluster center can be calculated and used as the new cluster center. The use of the average value can effectively reduce the cluster center deviation caused by extreme values ​​or noise, making the clustering more robust.

[0148] S305: Iterate each new cluster center and record the current iteration number.

[0149] It is understandable that after obtaining the new cluster center, each new cluster center is iterated, because the cluster center after the iteration can effectively avoid the overlap between different clusters, enhance the differentiation of clusters, and help improve the clarity and interpretability of classification. In addition, the current number of iterations needs to be recorded after the iteration, because by recording the number of iterations, it is possible to monitor whether the clustering algorithm has converged.

[0150] S306: Determine whether the current number of iterations meets the preset number of iterations.

[0151] It should be noted that in order to effectively manage the operation process of k-means clustering and ensure that the best optimization result is achieved within the given computing resources and time, it is possible to determine whether the current number of iterations meets the preset number of iterations, or the cluster center no longer changes (that is, the new cluster center is the same as the initial cluster center) to determine whether k-means clustering has given the best clustering result. Therefore, if the current number of iterations does not meet the preset number of iterations, it means that k-means clustering has not yet given the best clustering result, so step S307 is executed at this time. If the current number of iterations meets the preset number of iterations, it means that k-means clustering can already give the best clustering result, so step S308 is executed at this time.

[0152] S307: Take each new cluster center as an initial cluster center.

[0153] Specifically, when the current number of iterations does not meet the preset number of iterations, it means that it is necessary to continue selecting cluster centers for subsequent distance calculations. Therefore, each new cluster center needs to be used as the initial cluster center at this time, and return to execute step S303 until it is determined that the current number of iterations of the new cluster center meets the preset number of iterations.

[0154] S308: Use each new cluster center as a second cluster set for each recursive server IP address.

[0155] It is understandable that when the current number of iterations meets the preset number of iterations, it means that the clustering algorithm has converged and the new cluster center at this time has met the requirements, so each new cluster center needs to be used as the second cluster set of each recursive server IP address.

[0156] S105: Label the second cluster set of each recursive server IP address to obtain a second cluster label corresponding to each recursive server IP address.

[0157] It can be understood that after obtaining the second cluster set of each recursive server IP address, the second cluster set of each recursive server IP address is then labeled Tag_2. After clustering, IPs belonging to the same category will have the same label value, but IPs with the same label value are not necessarily the same IP, so as to determine whether multiple IP addresses belong to the same address pool.

[0158] S106: Mark each recursive server IP address with the same second clustering label as a target recursive server IP address, and perform semi-supervised clustering on each target recursive server IP address according to the domain name feature of each target recursive server IP address to obtain a third cluster set corresponding to each target recursive server IP address.

[0159] It should be noted that after completing the first clustering and the second clustering, the third clustering needs to be completed. In the third clustering, domain name features need to be used, and semi-supervised DBSCAN with no limit on the number of clusters is used for clustering within the recursive server IP addresses with the same second clustering label. In this way, the third clustering can be completed to obtain the third clustering set corresponding to each target recursive server IP address, where the target recursive server IP address is each recursive server IP address with the same second clustering label.

[0160] Optionally, in another embodiment of the present application, in step S106, a specific implementation method of performing semi-supervised clustering on each target recursive server IP address using the DBSCAN clustering algorithm according to the domain name features of each target recursive server IP address to obtain a third cluster set corresponding to each target recursive server IP address is as follows: Figure 4 As shown, the following steps are included:

[0161] S401. Randomly select a target recursive server IP address from all target recursive server IP addresses, and use the selected target recursive server IP address as a core recursive server IP address.

[0162] Specifically, randomly selecting a target recursive server IP address from the collected I target recursive server IP addresses can be implemented using a random function in a programming language. For example, in Python, random.choice() can be used to randomly select a target recursive server IP address.

[0163] For example, the sample code (Python):

[0164] pythonCopy Code

[0165] import random

[0166] #Assume this is a list of IP addresses of all target recursive servers

[0167] target_servers=[

[0168] "192.168.1.1",

[0169] "192.168.1.2",

[0170] "192.168.1.3",

[0171] "192.168.1.4", ]

[0173] #Randomly select a target recursive server IP address

[0174] core_recursive_server=random.choice(target_servers)

[0175] #Output the selected core recursive server IP address print(f"Core recursive server IP address: {core_recursive_server}").

[0176] S402: Based on the domain name feature of the core recursive server IP address, determine whether there is at least one target recursive server IP address within the radius of the core recursive server IP address.

[0177] It should be noted that in order to determine whether there is at least one target recursive server IP address within the radius of the core recursive server IP address based on the domain name features of the core recursive server IP address, first determine the radius of the core recursive server IP address to define the search range, then use the IP address query service (such as IP geolocation API) to obtain the geographic location (longitude and latitude) of the core recursive server IP address, then use the same IP query service to obtain the geographic location of all target recursive servers, and then use the domain name features of the core recursive server IP address to calculate the distance between the core recursive server and each target recursive server, and determine whether there is at least one target recursive server IP address within the radius of the core recursive server IP address based on the calculated distance. If so, execute step S403.

[0178] Optionally, if it does not exist, the target recursive server IP address is used as a third cluster set.

[0179] Optionally, the present application embodiment provides a method for obtaining the radius range of the core recursive server IP address, such as Figure 5 As shown, the following steps are included:

[0180] S501: The client sends multiple DNS request messages to the service-side recursive server, and the service-side recursive server forwards each DNS request message to the recursive service pool.

[0181] Specifically, in order to obtain the radius range, the client first needs to send multiple DNS request messages to the service-side recursive server. This service-side recursive server usually acts as an intermediary and is responsible for processing and forwarding requests. The client first needs to generate multiple DNS request messages, which may involve different domain name resolutions. Then the service-side recursive server forwards each DNS request message to the backend recursive service pool. The recursive service pool may contain multiple recursive DNS servers for load balancing and redundancy. Each DNS request message will contain the requested domain name, such as the requested domain name IP1.scan.example.

[0182] S502: Receive each DNS request message through the recursive service pool, and generate a query instruction corresponding to each DNS request message based on each DNS request message.

[0183] Specifically, one or more servers in the recursive service pool receive DNS request messages from the service-side recursive server. These messages contain the domain name information to be resolved. The servers in the recursive service pool parse the DNS request messages, extract key information, such as the requested domain name, query type (such as A record, AAAA record, CNAME, etc.) and other options, and then generate corresponding query instructions for each DNS request based on the extracted information. The query instructions include: query type: specify the type of record to be queried (such as A, AAAA, MX, etc.), domain name: the specific domain name to be queried, recursive flag: indicate whether a recursive query is required. The generated query instructions are sent to the authoritative DNS server, that is, this system.

[0184] S503: Receive a query instruction corresponding to each DNS request message sent by the recursive service pool, and obtain a source IP address corresponding to each DNS request message according to the query instruction corresponding to the DNS request message.

[0185] It is understandable that when receiving the query instruction corresponding to each DNS request message sent by the recursive service pool, it is necessary to obtain the requested domain name from the query instruction, and query the corresponding source IP address from the DNS record according to the requested domain name, so that the source IP addresses with the same domain name can be grouped into one category later. Among them, the source IP address refers to the recursive server IP address.

[0186] For example, the general recursive server adopts the strategy of deploying different IPs on the service side and the recursive side. For example, the client sees 8.8.8.8, but the IP that actually sends the request to the top-level domain is 74.xxx. At the same time, due to the load balancing strategy, there will be a lot of 74.xxx here. For example, if 8.8.8.8.scan.example is sent repeatedly to 8.8.8.8, the authoritative side will see that there will be many IPs like 74.xxx requesting the domain name 8.8.8.8.scan.example.

[0187] It should be noted that the structural diagram of the method for obtaining the semi-supervised constraint conditions described in steps S501 to S503 can be found in Figure 6 The content shown.

[0188] S504: Determine whether there is an identical domain name in all source IP addresses.

[0189] It is understandable that if the same domain name exists in all source IP addresses, step S505 is executed.

[0190] Optionally, if there is no identical domain name in all source IP addresses, each source IP address is treated as a category, and then the radius range of each category of source IP addresses is customized.

[0191] S505: Cluster each source IP address corresponding to the same domain name feature.

[0192] Specifically, when the same domain name exists in all source IP addresses, it is necessary to cluster each source IP address corresponding to the same domain name feature, that is, to associate these source IP addresses and record each source IP address after clustering as a type of must-connect constraint for subsequent semi-supervised clustering.

[0193] S506: Set the clustering distance between each clustered source IP address as a preset threshold, and use the preset threshold as the radius range of the core recursive server IP address.

[0194] Specifically, the cluster distance between each source IP address with a must-connect constraint is set to 0, and the cluster distance corresponding to the source IP address is used as the radius range of the core recursive server IP address.

[0195] S403: Cluster all target recursive server IP addresses within the radius of the core recursive server IP address to obtain a third cluster set corresponding to the core recursive server IP address.

[0196] It should be noted that when there is at least one target recursive server IP address within the radius of the core recursive server IP address, it can be considered that the target recursive server IP addresses within the radius belong to one cluster. Therefore, at this time, it is only necessary to cluster all the target recursive server IP addresses within the radius of the core recursive server IP address to obtain the third cluster set corresponding to the core recursive server IP address.

[0197] S404: Select any one target recursive server IP address except the core recursive server IP address from all target recursive server IP addresses, and use the selected target recursive server IP address as the next core recursive server IP address.

[0198] It can be understood that in the embodiment of the present application, it is necessary to extend the distance of each target recursive server IP address, so it is necessary to repeat steps S401 to S404, and the same target recursive server IP address cannot be selected as the core recursive server IP in each repetition, so as to avoid invalid clustering. Therefore, after the next core recursive server IP address is selected from all target recursive server IP addresses, it is necessary to return to execute step S402 until all target recursive server IP addresses are selected and the implementation methods of steps S402 and S403 are executed.

[0199] S107: Label the third cluster set corresponding to each target recursive server IP address to obtain a third cluster label corresponding to each target recursive server IP address.

[0200] It is understandable that after obtaining the third cluster set of each recursive server IP address, the third cluster set of each recursive server IP address is finally tagged Tag_3, so that it can be determined whether multiple IP addresses belong to the same address pool.

[0201] It should be noted that all Tag_1, Tag_2, and Tag_3 mentioned in this application are variables, and each class has three tags, and each tag is different in each class.

[0202] S108: searching for multiple recursive server IP addresses with the same three clustering labels from all recursive server IP addresses, and assigning the multiple recursive server IP addresses with the same three clustering labels to the same recursive address pool.

[0203] It can be understood that after all recursive server IP addresses obtain three cluster labels, they have the same<Tag_1,Tag_2,Tag_3> The recursive server IP addresses are determined to belong to the same recursive address pool.

[0204] The present application provides a method for dividing recursive server addresses, which extracts query information of multiple recursive servers from an authoritative side log, wherein the query information of a recursive server includes at least the recursive server IP address and the query behavior characteristics and domain name characteristics of the recursive server IP address; secondly, clustering the recursive server IP addresses corresponding to each recursive server according to the network segment bits of each recursive server IP address to obtain a first clustering set corresponding to each recursive server IP address; then labeling the first clustering set corresponding to each recursive server IP address to obtain a first clustering label corresponding to each recursive server IP address; then inputting the query behavior characteristics of each recursive server IP address into a clustering algorithm for unsupervised clustering to obtain a second clustering set for each recursive server IP address; and then clustering each recursive server IP address again. The second clustering set of the recursive server IP address is labeled to obtain the second clustering label corresponding to each recursive server IP address, and then each recursive server IP address with the same second clustering label is marked as the target recursive server IP address, and each target recursive server IP address is semi-supervised clustered according to the domain name characteristics of each target recursive server IP address to obtain the third clustering set corresponding to each target recursive server IP address, and then the third clustering set corresponding to each target recursive server IP address is labeled to obtain the third clustering label corresponding to each target recursive server IP address, and finally multiple recursive server IP addresses with the same three clustering labels are found from all recursive server IP addresses, and the multiple recursive server IP addresses with the same three clustering labels are attributed to the same recursive address pool. Therefore, based on the query behavior characteristics and domain name characteristics of the recursive server IP address and the recursive server IP address, a multi-level classification clustering method is performed, which can effectively find multiple recursive service IPs belonging to the same recursive server pool, thereby providing a comprehensive view and solving the problem of blind spots in management and monitoring.

[0205] Another embodiment of the present application provides a device for dividing recursive server addresses, such as Figure 7 As shown, it includes the following units:

[0206] The information extraction unit 701 is used to extract the query information of multiple recursive servers from the authority side log, wherein the query information of a recursive server at least includes the recursive server IP address and the query behavior characteristics and domain name characteristics of the recursive server IP address.

[0207] The first clustering unit 702 is used to cluster the recursive server IP address corresponding to each recursive server according to the network segment bit number of each recursive server IP address to obtain a first cluster set corresponding to each recursive server IP address.

[0208] The first labeling unit 703 is used to label the first cluster set corresponding to each recursive server IP address to obtain a first clustering label corresponding to each recursive server IP address.

[0209] The second clustering unit 704 is used to input the query behavior characteristics of each recursive server IP address into the clustering algorithm to perform unsupervised clustering to obtain a second clustering set of each recursive server IP address.

[0210] The second labeling unit 705 is used to label the second clustering set of each recursive server IP address to obtain a second clustering label corresponding to each recursive server IP address.

[0211] The third clustering unit 706 is used to mark each recursive server IP address with the same second clustering label as a target recursive server IP address, and perform semi-supervised clustering on each target recursive server IP address according to the domain name feature of each target recursive server IP address to obtain a third cluster set corresponding to each target recursive server IP address.

[0212] The third labeling unit 707 is used to label the third cluster set corresponding to each target recursive server IP address to obtain a third clustering label corresponding to each target recursive server IP address.

[0213] The attribution unit 708 is configured to search for multiple recursive server IP addresses with the same three clustering labels from all recursive server IP addresses, and attribute the multiple recursive server IP addresses with the same three clustering labels to the same recursive address pool.

[0214] It should be noted that the specific working process of the above-mentioned units in the embodiment of the present application can refer to steps S101 to S108 in the above-mentioned method embodiment, and will not be repeated here.

[0215] Optionally, in a device for dividing a recursive server address provided in another embodiment of the present application, the second clustering unit 704 includes:

[0216] The integration unit is used to obtain all recursive server IP addresses and integrate all recursive server IP addresses to obtain a data set.

[0217] The selection unit is used to randomly select K recursive server IP addresses from the data set as K initial clustering centers.

[0218] The first calculation unit is used to calculate the distance between the query behavior characteristics of the recursive server IP address and each initial cluster center for each recursive server IP address in the data set, and assign the recursive server IP address to the initial cluster center corresponding to the minimum distance to obtain the target cluster center.

[0219] The second calculation unit is used to calculate the average value of all target cluster centers respectively, and use the average value as the new cluster center.

[0220] Iteration unit, used to iterate each new cluster center and record the current iteration number.

[0221] The number determination unit is used to determine whether the current number of iterations meets the preset number of iterations.

[0222] If the current number of iterations does not meet the preset number of iterations, each new cluster center is used as the initial cluster center, and the execution is returned to each recursive server IP address in the data set, the distance between the query behavior characteristics of the recursive server IP address and each initial cluster center is calculated, and the recursive server IP address is assigned to the initial cluster center corresponding to the minimum distance to obtain the target cluster center.

[0223] As a unit, it is used to use each new cluster center as the second clustering set of each recursive server IP address if the current iteration number meets the preset iteration number.

[0224] Optionally, in a device for dividing a recursive server address provided in another embodiment of the present application, the third clustering unit 703 includes:

[0225] The selection unit is used to select any one target recursive server IP address from all target recursive server IP addresses, and use the selected target recursive server IP address as the core recursive server IP address.

[0226] The judging unit is used to judge whether there is at least one target recursive server IP address within the radius of the core recursive server IP address based on the domain name feature of the core recursive server IP address.

[0227] The clustering unit is configured to cluster all target recursive server IP addresses within the radius of the core recursive server IP address to obtain a third cluster set corresponding to the core recursive server IP address if there is at least one target recursive server IP address within the radius of the core recursive server IP address.

[0228] The return execution unit is used to select any target recursive server IP address except the core recursive server IP address from all target recursive server IP addresses, and use the selected target recursive server IP address as the next core recursive server IP address, and return to execute based on the domain name feature of the core recursive server IP address to determine whether there is at least one target recursive server IP address within the radius of the core recursive server IP address, until all target recursive server IP addresses are selected.

[0229] Optionally, in another embodiment of the present application, a device for dividing a recursive server address further includes:

[0230] The sending unit is used to send multiple DNS request messages to the service-side recursive server through the client, and the service-side recursive server forwards each DNS request message to the recursive service pool.

[0231] The generating unit is used to receive each DNS request message through the recursive service pool, and based on each DNS request message, generate a query instruction corresponding to each DNS request message.

[0232] The address acquisition unit is used to receive a query instruction corresponding to each DNS request message sent by the recursive service pool, and obtain a source IP address corresponding to each DNS request message according to the query instruction corresponding to the DNS request message.

[0233] The domain name determination unit is used to determine whether the same domain name exists in all source IP addresses.

[0234] If the same domain name exists in all source IP addresses, each source IP address corresponding to the same domain name will be clustered.

[0235] The setting unit is used to set the clustering distance between each source IP address after clustering as a preset threshold, and use the preset threshold as the radius range of the core recursive server IP address.

[0236] Optionally, in another embodiment of the present application, a device for dividing a recursive server address further includes:

[0237] Create a cell for creating a hash count table and initializing the value of each cell in the hash count table.

[0238] The record acquisition unit is used to acquire all query records from the database, wherein the query records at least include a domain name of a recursive server IP address of a recursive server.

[0239] The third calculation unit is used to calculate the hash value of each domain name by using a hash function, and store the hash value of each domain name in a cell included in the hash counting table.

[0240] The traversal unit is used to traverse all query records. Every time a domain name is traversed, the value of the cell corresponding to the domain name in the hash counting table is increased by 1.

[0241] The vector generating unit is used to generate a query content vector of the domain name based on the value of the domain name in the hash counting table after traversing all query records, and use the query content vector as the domain name feature of the recursive server IP address corresponding to the domain name.

[0242] It should be noted that the specific working process of each unit provided in the above embodiments of the present application can refer to the corresponding steps in the above method embodiments, and will not be repeated here.

[0243] It should also be noted that a recursive server address division device provided in an embodiment of the present application has the technical effects of any of the above embodiments, and the embodiments of the present application are not described in detail here.

[0244] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0245] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for dividing recursive server addresses, characterized in that: include: Extracting query information of multiple recursive servers from the authoritative side log; wherein the query information of one recursive server at least includes the recursive server IP address and the query behavior characteristics and domain name characteristics of the recursive server IP address; Clustering the recursive server IP addresses corresponding to each of the recursive servers according to the number of network segment bits of each of the recursive server IP addresses to obtain a first cluster set corresponding to each of the recursive server IP addresses; Labeling the first cluster set corresponding to each of the recursive server IP addresses to obtain a first cluster label corresponding to each of the recursive server IP addresses; Inputting the query behavior characteristics of each recursive server IP address into a clustering algorithm for unsupervised clustering to obtain a second clustering set of each recursive server IP address; Labeling the second cluster set of each recursive server IP address to obtain a second cluster label corresponding to each recursive server IP address; Marking each of the recursive server IP addresses having the same second clustering label as a target recursive server IP address, and performing semi-supervised clustering on each of the target recursive server IP addresses according to the domain name features of each of the target recursive server IP addresses to obtain a third clustering set corresponding to each of the target recursive server IP addresses; Labeling the third cluster set corresponding to each of the target recursive server IP addresses to obtain a third cluster label corresponding to each of the target recursive server IP addresses; A plurality of recursive server IP addresses having three consistent clustering labels are searched from all the recursive server IP addresses, and the plurality of recursive server IP addresses having three consistent clustering labels are assigned to the same recursive address pool.

2. The method according to claim 1, characterized in that The step of inputting the query behavior feature of each recursive server IP address into a clustering algorithm for unsupervised clustering to obtain a second clustering set of each recursive server IP address comprises: Obtaining all recursive server IP addresses, and integrating all the recursive server IP addresses to obtain a data set; Randomly select K recursive server IP addresses from the data set as K initial clustering centers; For each of the recursive server IP addresses in the data set, respectively, calculate the distance between the query behavior feature of the recursive server IP address and each of the initial cluster centers, and assign the recursive server IP address to the initial cluster center corresponding to the minimum distance to obtain the target cluster center; For all the target cluster centers, respectively, the average value of the target cluster centers is calculated, and the average value is used as the new cluster center; Iterate each of the new cluster centers and record the current number of iterations; Determine whether the current number of iterations meets a preset number of iterations; If the current number of iterations does not meet the preset number of iterations, each of the new cluster centers is used as the initial cluster center, and the process of returning to the step of calculating the distance between the query behavior characteristics of the recursive server IP address and each of the initial cluster centers for each of the recursive server IP addresses in the data set, and assigning the recursive server IP address to the initial cluster center corresponding to the minimum distance to obtain the target cluster center; If the current number of iterations meets the preset number of iterations, each of the new cluster centers is used as a second clustering set for each of the recursive server IP addresses.

3. The method according to claim 1, characterized in that The semi-supervised clustering is performed on each target recursive server IP address according to the domain name feature of each target recursive server IP address to obtain a third clustering set corresponding to each target recursive server IP address, including: Randomly select a target recursive server IP address from all target recursive server IP addresses, and use the selected target recursive server IP address as the core recursive server IP address; Based on the domain name feature of the core recursive server IP address, determining whether there is at least one target recursive server IP address within the radius of the core recursive server IP address; If there is at least one target recursive server IP address within the radius of the core recursive server IP address, clustering all target recursive server IP addresses within the radius of the core recursive server IP address to obtain a third cluster set corresponding to the core recursive server IP address; Select any one target recursive server IP address except the core recursive server IP address from all target recursive server IP addresses, and use the selected target recursive server IP address as the next core recursive server IP address, return to execute the domain name feature based on the core recursive server IP address, and determine whether there is at least one target recursive server IP address within the radius of the core recursive server IP address, until all target recursive server IP addresses are selected.

4. The method according to claim 3, characterized in that The method for obtaining the radius range of the core recursive server IP address includes: Sending multiple DNS request messages to the service-side recursive server through the client, and the service-side recursive server forwarding each of the DNS request messages to the recursive service pool; Receiving each of the DNS request messages through the recursive service pool, and generating a query instruction corresponding to each of the DNS request messages based on each of the DNS request messages; Receive a query instruction corresponding to each of the DNS request messages sent by the recursive service pool, and obtain a source IP address corresponding to each of the DNS request messages according to the query instruction corresponding to the DNS request message; Determine whether there is an identical domain name in all the source IP addresses; If there is a same domain name in all the source IP addresses, cluster each source IP address corresponding to the same domain name; The clustering distance between each source IP address after clustering is set as a preset threshold, and the preset threshold is used as the radius range of the core recursive server IP address.

5. The method according to claim 1, characterized in that The obtaining of domain name features of recursive server IP addresses of multiple recursive servers includes: Create a hash counting table and initialize the value of each cell in the hash counting table; Obtain all query records from the database; wherein the query records include at least a domain name of a recursive server IP address of a recursive server; Calculate the hash value of each domain name by using a hash function, and store the hash value of each domain name in a cell included in the hash counting table; Traversing all the query records, and adding 1 to the value of the cell corresponding to the domain name in the hash counting table each time the domain name is traversed; After traversing all the query records, a query content vector of the domain name is generated based on the value of the domain name in the hash counting table, and the query content vector is used as the domain name feature of the recursive server IP address corresponding to the domain name.

6. A device for dividing recursive server addresses, characterized in that: include: An information extraction unit, used to extract query information of multiple recursive servers from the authoritative side log; wherein the query information of one recursive server at least includes the recursive server IP address and the query behavior characteristics and domain name characteristics of the recursive server IP address; A first clustering unit, configured to cluster the recursive server IP addresses corresponding to each of the recursive servers according to the number of network segment bits of each of the recursive server IP addresses, to obtain a first cluster set corresponding to each of the recursive server IP addresses; A first labeling unit, configured to label a first cluster set corresponding to each of the recursive server IP addresses to obtain a first clustering label corresponding to each of the recursive server IP addresses; A second clustering unit, used for inputting the query behavior feature of each recursive server IP address into a clustering algorithm for unsupervised clustering to obtain a second clustering set of each recursive server IP address; A second labeling unit, configured to label the second clustering set of each recursive server IP address to obtain a second clustering label corresponding to each recursive server IP address; A third clustering unit is used to mark each of the recursive server IP addresses having the same second clustering label as a target recursive server IP address, and perform semi-supervised clustering on each target recursive server IP address according to a domain name feature of each target recursive server IP address to obtain a third cluster set corresponding to each target recursive server IP address; A third labeling unit, configured to label the third cluster set corresponding to each of the target recursive server IP addresses, to obtain a third clustering label corresponding to each of the target recursive server IP addresses; The attribution unit is used to search for multiple recursive server IP addresses with the same three clustering labels from all the recursive server IP addresses, and attribute the multiple recursive server IP addresses with the same three clustering labels to the same recursive address pool.

7. The device according to claim 6, characterized in that The second clustering unit comprises: An integration unit, used to obtain all recursive server IP addresses and integrate all the recursive server IP addresses to obtain a data set; A selection unit, used for randomly selecting K IP addresses of the recursive servers from the data set as K initial clustering centers; A first calculation unit is used to calculate the distance between the query behavior feature of the recursive server IP address and each of the initial cluster centers for each of the recursive server IP addresses in the data set, and assign the recursive server IP address to the initial cluster center corresponding to the minimum distance to obtain a target cluster center; A second calculation unit, used for calculating the average value of the target cluster centers for all the target cluster centers respectively, and taking the average value as a new cluster center; An iteration unit, used for iterating each of the new cluster centers and recording the current iteration number; A number determination unit, used to determine whether the current number of iterations meets a preset number of iterations; If the current number of iterations does not meet the preset number of iterations, each of the new cluster centers is used as the initial cluster center, and the process of returning to the step of calculating the distance between the query behavior characteristics of the recursive server IP address and each of the initial cluster centers for each of the recursive server IP addresses in the data set, and assigning the recursive server IP address to the initial cluster center corresponding to the minimum distance to obtain the target cluster center; As a unit, it is used to use each of the new cluster centers as the second clustering set of each of the recursive server IP addresses if the current number of iterations meets the preset number of iterations.

8. The device according to claim 6, characterized in that The third clustering unit comprises: A selection unit, used to select any one target recursive server IP address from all target recursive server IP addresses, and use the selected target recursive server IP address as a core recursive server IP address; A judging unit, configured to judge whether there is at least one target recursive server IP address within a radius of the core recursive server IP address based on a domain name feature of the core recursive server IP address; a clustering unit, configured to cluster all target recursive server IP addresses within the radius of the core recursive server IP address to obtain a third cluster set corresponding to the core recursive server IP address if there is at least one target recursive server IP address within the radius of the core recursive server IP address; The return execution unit is used to select any target recursive server IP address other than the core recursive server IP address from all target recursive server IP addresses, and use the selected target recursive server IP address as the next core recursive server IP address, return to execute the domain name feature based on the core recursive server IP address, and determine whether there is at least one target recursive server IP address within the radius of the core recursive server IP address, until all target recursive server IP addresses are selected.

9. The device according to claim 8, characterized in that Also includes: A sending unit, configured to send multiple DNS request messages to a service-side recursive server through a client, and the service-side recursive server forwards each of the DNS request messages to a recursive service pool; A generating unit, configured to receive each of the DNS request messages through the recursive service pool, and generate a query instruction corresponding to each of the DNS request messages based on each of the DNS request messages; An address acquisition unit, configured to receive a query instruction corresponding to each of the DNS request messages sent by the recursive service pool, and acquire a source IP address corresponding to the DNS request message according to the query instruction corresponding to the DNS request message for each of the DNS request messages; A domain name determination unit, used to determine whether there is an identical domain name in all the source IP addresses; If there is a same domain name in all the source IP addresses, cluster each source IP address corresponding to the same domain name; The setting unit is used to set the clustering distance between each source IP address after clustering as a preset threshold, and use the preset threshold as the radius range of the core recursive server IP address.

10. The device according to claim 6, characterized in that Also includes: A creation unit, used to create a hash counting table and initialize the value of each cell in the hash counting table; A record acquisition unit, used to acquire all query records from a database; wherein the query records include at least a domain name of a recursive server IP address of a recursive server; a third calculation unit, configured to calculate a hash value of each of the domain names by using a hash function, and store the hash value of each of the domain names in a cell included in the hash counting table; A traversal unit, used for traversing all the query records, and adding 1 to the value of the cell corresponding to the domain name in the hash counting table each time the domain name is traversed; A vector generating unit is used to generate a query content vector of the domain name based on the value of the domain name in the hash counting table after traversing all the query records, and use the query content vector as the domain name feature of the recursive server IP address corresponding to the domain name.

Images