Associated domain name detection method, system and device and storage medium

Abstract

The invention discloses an associated domain name detection method, system and device and a storage medium, and the method comprises the steps: obtaining traffic session information, and determining target domain name time sequence data corresponding to a plurality of source IP addresses according to the traffic session information; determining a transition probability from one domain name to another domain name in preset alternative domain names according to the target domain name time sequence data, and generating a transition probability matrix of the alternative domain names according to the transition probability; constructing a directed graph according to the alternative domain names and the transition probability matrix; determining a target domain name in the alternative domain names, determining a longest path between the target domain name and each other domain name in the alternative domain names according to the directed graph, and determining a path probability corresponding to each longest path; and screening out a plurality of target paths from the longest path according to the path probability, and determining an associated domain name of the target domain name according to the target paths. The method improves the accuracy and comprehensiveness of associated domain name detection, and can be applied to the technical field of network security.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method, system, device and storage medium for detecting associated domain names. Background Art

[0002] In recent years, SaaS (Software-as-a-Service) has become increasingly popular around the world and has become an important part of enterprise IT infrastructure. This cloud computing-based service model provides enterprises with flexible and scalable software solutions, enabling them to manage and use various applications more efficiently. With the widespread adoption of SaaS services, the network traffic of enterprises accessing these cloud applications has shown a significant growth trend, which not only reflects the success of the SaaS model, but also brings new challenges to enterprises' network management and security strategies.

[0003] Usually SaaS services are deployed in public clouds or data centers in different geographical locations. Although this distributed deployment method improves the availability and performance of services, it also brings some challenges. One of the most notable problems is that enterprises may encounter network instability and experience degradation when accessing SaaS services. These problems may be caused by factors such as network routing, server load, and cross-regional data transmission. It is particularly noteworthy that when domestic enterprises need to access SaaS services deployed overseas, or vice versa, when overseas enterprises access SaaS services deployed in China, the problem of network instability becomes more prominent. The main reason for this is that the international export bandwidth congestion of operators leads to unstable cross-border data transmission.

[0004] As a new generation of wide area network solutions, SD-WAN (Software Defined Wide Area Network) has become an important tool for optimizing the access experience of SaaS services. This technology can effectively improve network performance and reliability through intelligent routing and dynamic bandwidth allocation. SD-WAN can not only automatically select the best network path, but also allocate network resources according to the priority and performance requirements of applications, thereby significantly improving the access experience of SaaS services. In addition, the centralized management and visualization functions of SD-WAN also provide enterprises with better network control and monitoring capabilities, allowing IT teams to more quickly identify and resolve potential network problems.

[0005] In an enterprise network, there are usually multiple types of traffic that exist simultaneously in the network. Accurately identifying and distinguishing the traffic related to a specific SaaS service from these complex and diverse traffic is a key prerequisite for optimizing the SaaS service experience. However, with the development of the SaaS service ecosystem, a single SaaS service often calls other SaaS services in the same ecosystem, which makes it more complicated to distinguish the network traffic of a specific SaaS service. For example, when opening WeChat for Business, if the user uses the worktile component in its ecosystem, the user experience of accessing worktile is actually part of the WeChat for Business experience and needs to be optimized at the same time. However, the domain names, IP addresses, and application behaviors of worktile and WeChat for Business are different, so the traffic of worktile needs to be associated with WeChat for Business.

[0006] In the prior art, deep packet recognition technology or crawler technology is mostly used to detect associated domain names. However, these methods have the problems of incomplete detection and insufficient accuracy. Summary of the invention

[0007] The purpose of the present invention is to solve one of the technical problems existing in the prior art to at least a certain extent.

[0008] Therefore, an object of an embodiment of the present invention is to provide a method for detecting associated domain names, which improves the accuracy and comprehensiveness of detecting associated domain names.

[0009] Another object of an embodiment of the present invention is to provide a system for detecting associated domain names.

[0010] In order to achieve the above technical objectives, the technical solutions adopted by the embodiments of the present invention include:

[0011] In a first aspect, an embodiment of the present invention provides a method for detecting associated domain names, comprising the following steps:

[0012] Obtaining traffic session information, and determining destination domain name timing data corresponding to multiple source IP addresses according to the traffic session information;

[0013] Determine a transition probability from one domain name to another domain name in a preset candidate domain name according to the target domain name time series data, and generate a transition probability matrix of the candidate domain name according to the transition probability;

[0014] Constructing a directed graph according to the candidate domain names and the transition probability matrix;

[0015] Determine a target domain name among the candidate domain names, determine the longest path between the target domain name and each other domain name among the candidate domain names according to the directed graph, and determine the path probability corresponding to each of the longest paths;

[0016] A plurality of target paths are selected from the longest path according to the path probability, and an associated domain name of the target domain name is determined according to the target path.

[0017] Further, in an embodiment of the present invention, determining the destination domain name time series data corresponding to the multiple source IP addresses according to the traffic session information specifically includes:

[0018] Determine session identifiers corresponding to a plurality of traffic sessions according to the traffic session information, and determine a timestamp, a source IP address, and a destination IP address corresponding to each of the traffic sessions according to the session identifiers;

[0019] The destination domain name corresponding to each of the destination IP addresses is determined according to a preset IP-domain name mapping table, and then the destination domain name timing data is generated according to the timestamp corresponding to each of the source IP addresses and the destination domain name.

[0020] Furthermore, in one embodiment of the present invention, the associated domain name detection method further includes the step of updating the IP-domain name mapping table, which specifically includes:

[0021] Obtain a DNS message, and obtain a current mapping relationship between an IP address and a domain name according to the DNS message resolution;

[0022] The IP-domain name mapping table is updated according to the current mapping relationship.

[0023] Further, in an embodiment of the present invention, determining the transition probability from one domain name to another domain name in the preset candidate domain names according to the target domain name time series data, and generating the transition probability matrix of the candidate domain names according to the transition probability, specifically includes:

[0024] Determine a first timestamp corresponding to the first domain name according to the target domain name time series data, and determine a time window according to the first timestamp and a preset time interval;

[0025] The time series data of the destination domain name is intercepted according to the time window, and when a plurality of second domain names whose timestamps are within the time window are obtained, the access trigger count value from the first domain name to the second domain name is increased by 1;

[0026] Determine a first sum value of access trigger count values ​​from the first domain name to a plurality of the second domain names, and determine the transition probability from the first domain name to each of the second domain names according to a quotient of the access trigger count value from the first domain name to each of the second domain names and the first sum value;

[0027] The transition probability matrix is ​​obtained by taking the transition probability from one domain name to another domain name in the candidate domain names as the matrix element at the corresponding position.

[0028] Furthermore, in one embodiment of the present invention, the step of constructing a directed graph according to the candidate domain name and the transition probability matrix specifically includes:

[0029] Taking the candidate domain names as nodes, constructing directed edges from one domain name to another domain name in the candidate domain names;

[0030] The transition probability corresponding to each of the directed edges is determined according to the transition probability matrix, and the weight of each of the directed edges is determined according to the transition probability to obtain the directed graph.

[0031] Further, in one embodiment of the present invention, the determining of the path probability corresponding to each of the longest paths specifically includes:

[0032] Determine a corresponding number of target directed edges in the directed graph according to the longest path;

[0033] Determine the corresponding target transition probability according to the weight of the target directed edge, and determine the path probability according to the product of the target transition probabilities;

[0034] or,

[0035] The path weight of the longest path is determined according to the weight of the target directed edge, and the path probability is determined according to the path weight.

[0036] Further, in an embodiment of the present invention, the step of selecting a plurality of target paths from the longest path according to the path probability and determining the associated domain name of the target domain name according to the target path specifically includes:

[0037] Obtaining a preset probability threshold;

[0038] When the path probability is greater than the probability threshold, taking the corresponding longest path as the target path;

[0039] The candidate domain names corresponding to the intermediate nodes and the terminal nodes of the target path are used as the associated domain names of the target domain name.

[0040] In a second aspect, an embodiment of the present invention provides a system for detecting associated domain names, including:

[0041] A destination domain name determination module, used to obtain traffic session information and determine the destination domain name timing data corresponding to multiple source IP addresses according to the traffic session information;

[0042] A transition probability matrix generating module, used to determine the transition probability from one domain name to another domain name in the preset candidate domain names according to the target domain name time series data, and generate a transition probability matrix of the candidate domain names according to the transition probability;

[0043] A directed graph construction module, used to construct a directed graph according to the candidate domain names and the transition probability matrix;

[0044] A path probability determination module, used to determine a target domain name among the candidate domain names, determine the longest path between the target domain name and each other domain name among the candidate domain names according to the directed graph, and determine the path probability corresponding to each of the longest paths;

[0045] The associated domain name determination module is used to select a plurality of target paths from the longest path according to the path probability, and determine the associated domain name of the target domain name according to the target path.

[0046] In a third aspect, an embodiment of the present invention provides a device for detecting associated domain names, including:

[0047] at least one processor;

[0048] at least one memory for storing at least one program;

[0049] When the at least one program is executed by the at least one processor, the at least one processor implements the above-mentioned associated domain name detection method.

[0050] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, which stores a program executable by a processor, and the program executable by the processor is used to execute the above-mentioned associated domain name detection method when executed by the processor.

[0051] The advantages and beneficial effects of the present invention will be partly given in the following description, partly become apparent from the following description, or be understood through the practice of the present invention:

[0052] An embodiment of the present invention obtains traffic session information, determines destination domain name time series data corresponding to multiple source IP addresses according to the traffic session information, determines a transfer probability from one domain name to another domain name in a preset candidate domain name according to the destination domain name time series data, generates a transfer probability matrix of the candidate domain name according to the transfer probability, constructs a directed graph according to the candidate domain name and the transfer probability matrix, determines a target domain name in the candidate domain name, determines the longest path between the target domain name and each other domain name in the candidate domain name according to the directed graph, determines the path probability corresponding to each longest path, selects a plurality of target paths from the longest path according to the path probability, and determines an associated domain name of the target domain name according to the target path. The embodiment of the present invention determines the destination domain name time series data corresponding to different source IP addresses according to the traffic session information, determines the transfer probability between any two domain names in the candidate domain names according to the destination domain name time series data, obtains the transfer probability matrix of all the candidate domain names, and then constructs a directed graph based on the transfer probability matrix, determines the longest path and the corresponding path probability between the target domain name and other domain names according to the directed graph, screens out the target path according to the path probability, and uses other domain names on the target path as associated domain names of the target domain name, so as to realize automatic detection of associated domain names of various forms of SaaS services, and improves the accuracy and comprehensiveness of associated domain name detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the technical solution in the embodiments of the present invention, the following introduction is made to the drawings required for use in the embodiments of the present invention. It should be understood that the drawings introduced below are only for the convenience of clearly describing some embodiments of the technical solution of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0054] Figure 1 A flowchart of a method for detecting associated domain names provided by an embodiment of the present invention;

[0055] Figure 2 A structural block diagram of a related domain name detection system provided by an embodiment of the present invention;

[0056] Figure 3 A structural block diagram of a device for detecting associated domain names provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0057] The embodiments of the present invention are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and are not to be construed as limitations of the present invention. For the step numbers in the following embodiments, they are only provided for the convenience of explanation, and the order between the steps is not limited in any way, and the execution order of each step in the embodiment can be adaptively adjusted according to the understanding of those skilled in the art.

[0058] In the description of the present invention, the meaning of "a plurality" is two or more than two. If there is a description of "a first" or "a second", it is only used for the purpose of distinguishing technical features, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features or implicitly indicating the order of the indicated technical features. In addition, unless otherwise defined, all technical and scientific terms used in this document have the same meaning as those commonly understood by those skilled in the art.

[0059] In the prior art, deep packet recognition technology or crawler technology is mostly used to detect associated domain names. These two methods are first introduced and explained below.

[0060] Deep Packet Inspection (DPI) is a network packet analysis method that can check the content of the packet, not just the header information. Therefore, DPI can deeply analyze the application layer content of network traffic to identify specific applications, protocols or behavior patterns, and can also be applied to the detection of associated domain names. DPI technology relies on the application layer feature information in network packets. However, with the improvement of security awareness and privacy protection in recent years, most SaaS services will encrypt traffic at the application layer. The anonymity of encryption technology naturally conceals the feature information in the application traffic, which also makes DPI technology ineffective. In addition, since most SaaS services are accessed through the Internet, the network traffic of users accessing SaaS through the Internet will go through source address translation (Source NAT, Source Network Address Translate). Since NAT operation is stateful, this requires that when scheduling SaaS service network traffic, the first packet needs to determine the scheduling strategy, and the subsequent packets of the same session cannot easily change the scheduling strategy. Otherwise, if the Internet exit is changed, the original NAT session will be interrupted. This results in that for DPI technology, only the first packet is seen, and the feature information of the application is usually not found, which affects the accuracy and comprehensiveness of the associated domain name detection.

[0061] For SaaS services in the form of WEB, the industry usually uses web crawler technology to solve the problem of associated domain name detection. Web crawler technology is an automated program that can simulate the browsing behavior of real users and systematically access and crawl the content of a specified website. This technology sends HTTP requests, parses the returned HTML pages, and extracts the required information according to predefined rules. Through the information captured by the crawler, the URL of each SaaS service called by the website can be analyzed. However, this method has the following problems:

[0062] 1) Crawler technology has poor support for dynamic web pages, while modern web applications and most websites are filled with a large number of dynamic web pages. Dynamic web pages refer to web pages whose content is not static and fixed, but dynamically generated based on user interaction, database query or other real-time factors. Some dynamic content may require specific user operations or JavaScript execution to display, which is difficult for ordinary crawlers to trigger or capture.

[0063] 2) Crawler technology can only be effective for web applications. However, many SaaS services do not interact with users in the form of web applications, but in the form of mobile applications or computer software. Crawler technology is powerless against these SaaS services.

[0064] 3) With the development of SaaS services and the evolution of the ecosystem, the target of the request will also change, and the domain name list needs to be updated regularly. However, this update is often not very timely. It is often updated only when users report problems, and it is impossible to automatically detect and update the associated domain name list.

[0065] 4) Different companies may need to access different domain names when accessing the same SaaS service. For example, for the same enterprise WeChat, company A uses the Worktile plug-in, while company B uses the Tower plug-in. In other words, the access targets of companies A and B are different, but crawler technology is difficult to adapt to the special access needs of different users.

[0066] From the above, we can see that the detection of associated domain names through crawler technology also has the problems of incomplete detection and insufficient accuracy.

[0067] In the deployment of SDWAN technology to optimize the SaaS access experience, SDWAN CPE usually serves as the enterprise's egress gateway. Customer traffic accessing the Internet is aggregated to the SDWAN CPE device, which then identifies different applications in the network traffic and enables different optimization strategies.

[0068] The embodiment of the present invention takes the SDWAN CPE device as an example to illustrate the associated domain name detection method of the present invention. It should be noted that the associated domain name detection method of the embodiment of the present invention can also be implemented on a common egress router and is not limited to the SDWAN solution.

[0069] The embodiment of the present invention monitors the user's Internet traffic through CPE bypass to obtain the time series of the user's access to the target domain name, and models each domain name visited as a state in a Markov Chain. Each time the user initiates a request, it may trigger multiple subsequent sub-requests, and some sub-requests may access different domain names. This process is modeled as a state transition in the Markov chain. The transition probability between each domain name is observed and detected in an observation window (such as 10 minutes), and a transition probability matrix between each domain name can be established. Based on the transition probability matrix, the probability value of any domain name A triggering access to any domain name B can be calculated, and it can be determined whether B is an associated domain name of A.

[0070] It is understandable that the embodiment of the present invention does not directly use DNS requests and responses to train the transition probability matrix, because in the enterprise intranet, different devices may cache DNS results, such as WIFI AP, personal computers, core routers, etc., so the timing relationship between DNS requests and the timing relationship of the user actually initiating the service request have a large deviation, and cannot be directly used to train the transition probability matrix between domain names.

[0071] Reference Figure 1 The embodiment of the present invention provides a method for detecting associated domain names, which specifically includes the following steps:

[0072] S101, obtaining traffic session information, and determining destination domain name time series data corresponding to multiple source IP addresses according to the traffic session information;

[0073] S102, determining a transition probability from one domain name to another domain name in a preset candidate domain name according to the target domain name time series data, and generating a transition probability matrix of the candidate domain name according to the transition probability;

[0074] S103, constructing a directed graph according to the candidate domain names and the transition probability matrix;

[0075] S104, determining a target domain name among the candidate domain names, determining the longest path between the target domain name and each other domain name among the candidate domain names according to the directed graph, and determining the path probability corresponding to each longest path;

[0076] S105: Filter out a number of target paths from the longest path according to the path probability, and determine the associated domain name of the target domain name according to the target path.

[0077] The embodiment of the present invention determines the destination domain name time series data corresponding to different source IP addresses according to the traffic session information, determines the transfer probability between any two domain names in the candidate domain names according to the destination domain name time series data, obtains the transfer probability matrix of all the candidate domain names, and then constructs a directed graph based on the transfer probability matrix, determines the longest path and the corresponding path probability between the target domain name and other domain names according to the directed graph, screens out the target path according to the path probability, and uses other domain names on the target path as associated domain names of the target domain name, so as to realize automatic detection of associated domain names of various forms of SaaS services, and improves the accuracy and comprehensiveness of associated domain name detection.

[0078] Further as an optional implementation, determining the destination domain name time series data corresponding to the multiple source IP addresses according to the traffic session information specifically includes:

[0079] S1011, determining session identifiers corresponding to multiple traffic sessions according to the traffic session information, and determining a timestamp, a source IP address, and a destination IP address corresponding to each traffic session according to the session identifier;

[0080] S1012. Determine the destination domain name corresponding to each destination IP address according to a preset IP-domain name mapping table, and then generate destination domain name timing data according to the timestamp and destination domain name corresponding to each source IP address.

[0081] Specifically, the traffic session in the network is monitored through the CPE device. Traffic session is a basic concept in network communication, which refers to a series of related data packets exchanged between two network endpoints within a specific time. A traffic session usually represents a complete network interaction process, such as a web page access, a file download, or an instant messaging conversation. The traffic session is identified by a five-tuple, including: source IP address, that is, the IP address of the device initiating the communication; source port, that is, the port number used by the application initiating the communication; destination IP address, that is, the IP address of the device receiving the communication; destination port, that is, the port number used by the application receiving the communication; network protocol, that is, the protocol used for communication, such as TCP or UDP.

[0082] According to the session identifier of each traffic session in the traffic session record, the corresponding timestamp, source IP address and destination IP address of each traffic session can be parsed. The destination IP address can be converted into the corresponding destination domain name according to the preset IP-domain name mapping table to obtain the time series of user requests. Each session corresponds to a node in the time series, which can be expressed as <timestamp, source IP address, destination domain name>, where for a session, the timestamp refers to the time when the session starts, the source IP address indicates the initiator of the session, and the destination domain name indicates the domain name accessed by the session.

[0083] Split the above time series into destination domain name time series data corresponding to multiple source IP addresses according to the source IP address. Each source IP address maintains its own destination domain name time series data, which can reflect the domain names accessed by the traffic sessions initiated by the source IP address at different times.

[0084] It should be noted that for the same source IP address, within a preset time period, if a domain name appears multiple times, only the first recorded destination domain name time series data is taken. This time period represents the maximum time window during which the same group of user requests persists, usually with a value between 1 and 30 seconds. In the embodiments of the present invention, the time period is set to 5 seconds.

[0085] Further as an optional implementation manner, the domain name detection method further includes the step of updating the IP-domain name mapping table, which specifically includes:

[0086] S1001. Obtain the DNS packet, and parse the current mapping relationship between the IP address and the domain name according to the DNS packet;

[0087] S1002. Update the IP-domain name mapping table according to the current mapping relationship.

[0088] Specifically, in the embodiments of the present invention, first collect the mapping table of <IP address, domain name>, and then according to this mapping table, restore the IP addresses in the user network traffic to domain name information. Each site of the enterprise independently maintains a mapping table of <IP address, domain name> because with the wide application of CDN technology, the mapping relationship between IP addresses and domain names is no longer fixed. For example, when accessing a.com, DNS often resolves different IP addresses when accessing from Shanghai and Beijing. Therefore, it is not appropriate to globally maintain a static DNS database.

[0089] In the embodiments of the present invention, the CPE device listens to the DNS packets and parses the current mapping relationship between the IP address and the domain name from them, so as to build a real-time and dynamically changing IP-domain name mapping table exclusive to the current site.

[0090] Further as an optional implementation manner, determine the transition probability from one domain name to another among the preset alternative domain names according to the destination domain name time series data, and generate a transition probability matrix of the alternative domain names, which specifically includes:

[0091] S1021. Determine the first time stamp corresponding to the first domain name according to the destination domain name time series data, and determine the time window according to the first time stamp and the preset time interval;

[0092] S1022, intercepting the time series data of the destination domain name according to the time window, and when obtaining a plurality of second domain names whose timestamps are within the time window, increasing the access trigger count value from the first domain name to the second domain name by 1;

[0093] S1023, determining a first sum value of access trigger count values ​​from the first domain name to multiple second domain names, and determining a transfer probability from the first domain name to each second domain name according to a quotient of the access trigger count value from the first domain name to each second domain name and the first sum value;

[0094] S1024: Taking the transition probability from one domain name to another domain name in the candidate domain names as the matrix element at the corresponding position, to obtain a transition probability matrix.

[0095] Specifically, for the destination domain name time series data corresponding to each source IP address, the following algorithm is executed:

[0096] Define elemAll as the destination domain name sequence corresponding to the source IP address <timestamp ts, destination domain name domain>;

[0097] Define domainCnt(i,j) as the number of times a visit to domain name i triggers a visit to domain name j;

[0098] for elemin elemAll:

[0099] Intercept the elements whose timestamps are distributed in [elem.ts,elem.ts+timeWindow), succElemAll;

[0100] if succElemAll is empty:

[0101] domainCnt(elem.domain,elem.domain) count plus 1;

[0102] else

[0103] for succElemin succElemAll:

[0104] domainCnt(elem.domain,succElem.domain) count increases by 1.

[0105] The above algorithm can be used to determine the access trigger count value domainCnt(i,j) of any domain name in the candidate domain names to another domain name. Assume that for domain name i, there are a total of m other candidate domain names (including domain name j), which are d1,…,d m , then the transfer probability from domain name i to domain name j can be calculated by the following formula:

[0106]

[0107] Where p(i,j) represents the transfer probability from domain i to domain j, domainCnt(i,k) represents the access trigger count value from domain i to domain k, k = d1,…,d m .

[0108] In the embodiment of the present invention, 10 minutes is taken as an observation window by default (that is, the time interval timeWindow is set to 10 minutes), and the transition probability matrix is ​​calculated independently in each observation window.

[0109] As an optional implementation, a directed graph is constructed according to the candidate domain names and the transition probability matrix, which specifically includes:

[0110] S1031, using the candidate domain name as a node, constructing a directed edge from one domain name to another domain name in the candidate domain name;

[0111] S1032. Determine the transition probability corresponding to each directed edge according to the transition probability matrix, and determine the weight of each directed edge according to the transition probability to obtain a directed graph.

[0112] Specifically, the transition probability matrix is ​​converted into a weighted directed graph, where each domain name corresponds to a node in the directed graph. Each value p(i,j) in the transition probability matrix corresponds to an edge in the directed graph, and the corresponding weight is log(p(i,j)).

[0113] The reasons for converting the weights in the graph from probability values ​​of (0,1] to logarithms are as follows:

[0114] For Path<e1,e2,e3,e4> , the end-to-end path probability is p(e1,e2)×p(e2,e3)×p(e3,e4), and the value range of probability p(i,j) is (0-1]. This results in that multiplication of multiple transition probabilities may require processing of floating-point numbers with very small values, which is inconvenient in actual implementation. Therefore, in the embodiment of the present invention, the logarithm of p(i,j) is taken as the weight of the directed edge log(p(i,j)). The base of the logarithmic function can be 10 or e. Considering that the logarithmic function has the following characteristics:

[0115] log(p(e1,e2)×p(e2,e3)×p(e3,e4))=log(p(e1,e2))+log(p(e2,e3))+log(p(e3,e4))

[0116] Therefore, the multiplication of multiple transition probabilities is converted into the addition of multiple weights, reducing the complexity of the calculation.

[0117] Further as an optional implementation, determining the path probability corresponding to each longest path specifically includes:

[0118] S1041. Determine a number of corresponding target directed edges in the directed graph according to the longest path;

[0119] S1042, determining the corresponding target transfer probability according to the weight of the target directed edge, and determining the path probability according to the product of the target transfer probabilities;

[0120] or,

[0121] S1043. Determine the path weight of the longest path according to the weight of the target directed edge, and determine the path probability according to the path weight.

[0122] Specifically, for a specified SaaS service, its initial domain name can be obtained relatively easily; for a WEB-based SaaS service, the entry domain name is the domain name of its homepage, such as the Feishu application, the entry domain name is feishu.cn; for non-WEB-based SaaS services, it is usually not difficult to obtain several related domain names by monitoring DNS request and response messages.

[0123] The problem to be solved by the present invention can be specifically defined as: given one or more target domain names, it is necessary to automatically detect a list of other domain names that may be accessed in the sub-requests triggered during the process of accessing these target domain names.

[0124] After knowing the transfer probability matrix P(i,j) between domain names, the corresponding weighted directed graph and the target domain name a, for all other candidate domain names b, calculate the longest path from domain name a to each domain name b in the directed graph; determine one or more target directed edges corresponding to the longest path, and calculate the path probability according to the weights of each target directed edge. There are two calculation methods. One is to determine the corresponding target transfer probability according to the weight of the target directed edge, and then obtain the path probability according to the product of all target transfer probabilities. The other is to use the logarithmic characteristics of the weight log(p(i,j)) to convert the multiplication problem of the target transfer probability into the addition problem of the weight, that is, to obtain the path weight of the longest path according to the sum of the weights of all target directed edges, and then use the path weight as the power of the exponential function to calculate the path probability.

[0125] It should be noted that the method for calculating the longest path may adopt an existing path planning algorithm, which is not the focus of the embodiment of the present invention and will not be elaborated here.

[0126] As an optional implementation method, a plurality of target paths are selected from the longest path according to the path probability, and the associated domain name of the target domain name is determined according to the target path, which specifically includes:

[0127] S1051. Obtain a preset probability threshold;

[0128] S1052, when the path probability is greater than the probability threshold, taking the corresponding longest path as the target path;

[0129] S1053: Use the candidate domain names corresponding to the intermediate nodes and the terminal nodes of the target path as associated domain names of the target domain name.

[0130] Specifically, for each longest path probability, determine whether the path probability is greater than a preset probability threshold. If so, take the corresponding longest path as the target path, and take other domain names in the target path except the target domain name (i.e., the alternative domain names corresponding to the intermediate nodes and the terminal nodes) as associated domain names of the target domain name and add them to the associated domain name list.

[0131] It should be noted that the probability threshold in the embodiment of the present invention is an empirical value. The larger the value, the lower the false alarm rate of the result, but it may take longer to collect data to avoid missing some associated domain names. In the embodiment of the present invention, the default probability threshold is 10%.

[0132] The above is an explanation of the method steps of the embodiment of the present invention. It can be recognized that the embodiment of the present invention determines the destination domain name timing data corresponding to different source IP addresses based on the traffic session information, determines the transfer probability between any two domain names in the candidate domain names based on the destination domain name timing data, obtains the transfer probability matrix of all candidate domain names, and then constructs a directed graph based on the transfer probability matrix, determines the longest path and corresponding path probability between the target domain name and other domain names based on the directed graph, and selects the target path based on the path probability, thereby using other domain names on the target path as associated domain names of the target domain name, which can realize automatic detection of associated domain names of various forms of SaaS services, and improve the accuracy and comprehensiveness of associated domain name detection.

[0133] Compared with the prior art, the embodiments of the present invention also have the following advantages:

[0134] 1) Timely update: The embodiment of the present invention can automatically detect the list of associated domain names of a specified SaaS service. If a new associated domain name is added due to a business update of the SaaS service, the list can be automatically updated in a timely manner.

[0135] 2) Support various forms of SaaS services, not limited to WEB forms.

[0136] Reference Figure 2 The embodiment of the present invention provides a system for detecting associated domain names, including:

[0137] A destination domain name determination module, used to obtain traffic session information and determine the destination domain name timing data corresponding to multiple source IP addresses according to the traffic session information;

[0138] A transition probability matrix generating module, used to determine the transition probability from one domain name to another domain name in the preset candidate domain names according to the target domain name time series data, and generate a transition probability matrix of the candidate domain names according to the transition probability;

[0139] A directed graph construction module, used to construct a directed graph according to the candidate domain names and the transition probability matrix;

[0140] A path probability determination module, used to determine a target domain name among the candidate domain names, determine the longest path between the target domain name and each other domain name among the candidate domain names according to the directed graph, and determine the path probability corresponding to each of the longest paths;

[0141] The associated domain name determination module is used to select a plurality of target paths from the longest path according to the path probability, and determine the associated domain name of the target domain name according to the target path.

[0142] The contents of the above method embodiments are all applicable to the present system embodiments. The functions specifically implemented by the present system embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0143] Reference Figure 3 The embodiment of the present invention provides a device for detecting associated domain names, including:

[0144] at least one processor;

[0145] at least one memory for storing at least one program;

[0146] When the at least one program is executed by the at least one processor, the at least one processor implements the associated domain name detection method.

[0147] The contents of the above method embodiments are all applicable to the present device embodiments. The functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0148] An embodiment of the present invention further provides a computer-readable storage medium, in which a program executable by a processor is stored. When the program executable by the processor is executed by the processor, it is used to execute the above-mentioned associated domain name detection method.

[0149] A computer-readable storage medium according to an embodiment of the present invention can execute an associated domain name detection method provided by an embodiment of the method of the present invention, can execute any combination of implementation steps of the method embodiment, and has the corresponding functions and beneficial effects of the method.

[0150] The embodiment of the present invention also discloses a computer program product or a computer program, wherein the computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes Figure 1 The method shown.

[0151] In some selectable embodiments, the function / operation mentioned in the block diagram may not occur in the order mentioned in the operation diagram. For example, depending on the function / operation involved, the two boxes shown in succession can actually be executed substantially simultaneously or the above-mentioned boxes can sometimes be executed in reverse order. In addition, the embodiment presented and described in the flow chart of the present invention is provided by way of example, for the purpose of providing a more comprehensive understanding of technology. The disclosed method is not limited to the operation and logic flow presented herein. Selectable embodiments are expected, wherein the order of various operations is changed and the sub-operation of a part for which is described as a larger operation is performed independently.

[0152] In addition, although the present invention is described in the context of functional modules, it should be understood that, unless otherwise specified to the contrary, one or more of the above-mentioned functions and / or features can be integrated into a single physical device and / or software module, or one or more functions and / or features can be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the present invention. More specifically, in view of the properties, functions and internal relationships of the various functional modules in the device disclosed herein, the actual implementation of the module will be understood within the conventional skills of the engineer. Therefore, those skilled in the art can implement the present invention set forth in the claims without excessive experimentation using ordinary techniques. It is also understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of the present invention, which is determined by the full scope of the appended claims and their equivalents.

[0153] If the above functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the above methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0154] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0155] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and editable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the above-mentioned program is printed, since the above-mentioned program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or processing in other suitable ways as necessary, and then stored in a computer memory.

[0156] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0157] In the above description of this specification, the description with reference to the terms "one embodiment / example", "another embodiment / example" or "certain embodiments / examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0158] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.

[0159] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the above embodiments. Those skilled in the art may make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of this application.

Claims

1. A method for detecting associated domain names, characterized in that: The following steps are involved: Obtaining traffic session information, and determining destination domain name timing data corresponding to multiple source IP addresses according to the traffic session information; Determine a transition probability from one domain name to another domain name in a preset candidate domain name according to the target domain name time series data, and generate a transition probability matrix of the candidate domain name according to the transition probability; Constructing a directed graph according to the candidate domain names and the transition probability matrix; Determine a target domain name among the candidate domain names, determine the longest path between the target domain name and each other domain name among the candidate domain names according to the directed graph, and determine the path probability corresponding to each of the longest paths; A plurality of target paths are selected from the longest path according to the path probability, and an associated domain name of the target domain name is determined according to the target path.

2. A method for detecting associated domain names according to claim 1, characterized in that: The determining, according to the traffic session information, the destination domain name time series data corresponding to the multiple source IP addresses specifically includes: Determine session identifiers corresponding to a plurality of traffic sessions according to the traffic session information, and determine a timestamp, a source IP address, and a destination IP address corresponding to each of the traffic sessions according to the session identifiers; The destination domain name corresponding to each of the destination IP addresses is determined according to a preset IP-domain name mapping table, and then the destination domain name timing data is generated according to the timestamp corresponding to each of the source IP addresses and the destination domain name.

3. A method for detecting associated domain names according to claim 2, characterized in that: The associated domain name detection method further includes the step of updating the IP-domain name mapping table, which specifically includes: Obtain a DNS message, and obtain a current mapping relationship between an IP address and a domain name according to the DNS message resolution; The IP-domain name mapping table is updated according to the current mapping relationship.

4. The method for detecting associated domain names according to claim 1, characterized in that: The step of determining the transition probability from one domain name to another domain name in the preset candidate domain names according to the target domain name time series data, and generating a transition probability matrix of the candidate domain names according to the transition probability, specifically includes: Determine a first timestamp corresponding to the first domain name according to the target domain name time series data, and determine a time window according to the first timestamp and a preset time interval; The time series data of the destination domain name is intercepted according to the time window, and when a plurality of second domain names whose timestamps are within the time window are obtained, the access trigger count value from the first domain name to the second domain name is increased by 1; Determine a first sum value of access trigger count values ​​from the first domain name to a plurality of the second domain names, and determine the transition probability from the first domain name to each of the second domain names according to a quotient of the access trigger count value from the first domain name to each of the second domain names and the first sum value; The transition probability matrix is ​​obtained by taking the transition probability from one domain name to another domain name in the candidate domain names as the matrix element at the corresponding position.

5. The method for detecting associated domain names according to claim 1, characterized in that: The step of constructing a directed graph according to the candidate domain names and the transition probability matrix specifically includes: Taking the candidate domain names as nodes, constructing directed edges from one domain name to another domain name in the candidate domain names; The transition probability corresponding to each of the directed edges is determined according to the transition probability matrix, and the weight of each of the directed edges is determined according to the transition probability to obtain the directed graph.

6. A method for detecting associated domain names according to claim 1, characterized in that: The determining of the path probability corresponding to each of the longest paths specifically includes: Determine a corresponding number of target directed edges in the directed graph according to the longest path; Determine the corresponding target transition probability according to the weight of the target directed edge, and determine the path probability according to the product of the target transition probabilities; or, The path weight of the longest path is determined according to the weight of the target directed edge, and the path probability is determined according to the path weight.

7. A method for detecting associated domain names according to any one of claims 1 to 6, characterized in that: The step of selecting a plurality of target paths from the longest path according to the path probability, and determining the associated domain name of the target domain name according to the target path specifically includes: Obtaining a preset probability threshold; When the path probability is greater than the probability threshold, taking the corresponding longest path as the target path; The candidate domain names corresponding to the intermediate nodes and the terminal nodes of the target path are used as the associated domain names of the target domain name.

8. A system for detecting associated domain names, characterized in that: include: A destination domain name determination module, used to obtain traffic session information and determine the destination domain name timing data corresponding to multiple source IP addresses according to the traffic session information; A transition probability matrix generating module, used to determine the transition probability from one domain name to another domain name in the preset candidate domain names according to the target domain name time series data, and generate a transition probability matrix of the candidate domain names according to the transition probability; A directed graph construction module, used to construct a directed graph according to the candidate domain names and the transition probability matrix; A path probability determination module, used to determine a target domain name among the candidate domain names, determine the longest path between the target domain name and each other domain name among the candidate domain names according to the directed graph, and determine the path probability corresponding to each of the longest paths; The associated domain name determination module is used to select a plurality of target paths from the longest path according to the path probability, and determine the associated domain name of the target domain name according to the target path.

9. A device for detecting associated domain names, characterized in that: include: at least one processor; at least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements the associated domain name detection method according to any one of claims 1 to 7.

10. A computer-readable storage medium storing a program executable by a processor, characterized in that: The processor-executable program is used to execute a method for detecting associated domain names as claimed in any one of claims 1 to 7 when executed by the processor.

Images