Export parser identification method and device, equipment, storage medium and product

Abstract

The embodiment of the invention provides an exit parser identification method and device, equipment, a storage medium and a product. The method comprises the steps of obtaining a network protocol address of a target parser; sending a preset domain name query request to a target analyzer from a plurality of different network environments to determine a target client; generating a sub-domain name for the target resolver based on a preset rule; splicing the sub-domain name with the first root domain name, and determining a first detection domain name of the target resolver; controlling the target client to send an analysis request for the first detection domain name to a target analyzer; receiving all response data packets sent by the first server, and screening all the response data packets according to the first detection domain name and the first preset analysis result to obtain a first target data packet; obtaining source IPs of all the analysis requests from the first target data packet to obtain a preferred exit IP set; and determining the service corresponding to the preferred exit IP set as a preferred exit parser. The method is used for achieving the effect of identifying the exit parser.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an export parser identification method, device, equipment, storage medium and product. Background Art

[0002] DNS (Domain Name System) is a key component of the Internet infrastructure, responsible for converting human-readable domain names into machine-readable IP addresses. As DNS infrastructure becomes more complex, DNS resolution paths may become more dynamic and changeable, making it more important to identify and monitor all network assets involved in DNS resolution.

[0003] In the prior art, DNS detection technology mainly focuses on identifying the initial entry of the resolution request, but is unable to identify other servers passed through the network, making it difficult to fully understand the complete path of DNS resolution, thereby ignoring potential security risks. Summary of the invention

[0004] Embodiments of the present application provide an egress parser identification method, apparatus, device, storage medium, and product to achieve the effect of identifying an egress parser.

[0005] In a first aspect, an embodiment of the present application provides an export resolver identification method, which is applied to a computer device, including: obtaining a network protocol address IP of a target resolver; sending a preset domain name query request to the target resolver from multiple different network environments, and determining a target client based on a response of the target resolver; based on preset rules, generating a subdomain name for the target resolver according to the target resolver IP; concatenating the subdomain name with the first root domain name to determine a first detection domain name of the target resolver, wherein all subdomain names of the first root domain name can be normally resolved on a first server and return a first preset resolution result; controlling the target client to send a resolution request for the first detection domain name to the target resolver, so that the target resolver sends a request data packet to the first server; receiving all response data packets sent by the first server, and screening all response data packets according to the first detection domain name and the first preset resolution result to obtain a first target data packet; obtaining the source IP of all resolution requests from the first target data packet to obtain a preferred export IP set; determining the service corresponding to the preferred export IP set as the preferred export resolver.

[0006] In a possible implementation, it also includes: concatenating the subdomain name with the second root domain name to determine the second detection domain name of the target resolver, wherein all subdomain names of the second root domain name are resolved on the second server and return a second preset resolution result; controlling the target client to send a resolution request for the second detection domain name to the target resolver, so that the target client sends a request data packet to the second server; accepting all response data packets sent by the second server, and filtering all response data packets according to the second detection domain name and the second preset resolution result to obtain a second target data packet; obtaining all source IPs of all resolution requests from the second target data packet; traversing all source IPs, eliminating the preferred export IP set, and obtaining an alternative export IP set; determining the service corresponding to the alternative export IP set as the alternative export resolver.

[0007] In a possible implementation, a preset domain name query request is sent to a target resolver from a plurality of different network environments, and a target client is determined based on a response of the target resolver, including: sending the preset domain name request from a plurality of different network environments to the target resolver, wherein the plurality of different network environments include at least a home network, an enterprise network, and a public network; receiving a return result from the target resolver; if the target resolver returns valid domain name system records, the target resolver is determined to be an open resolver; if the target resolver returns valid domain name system records only in a specific network environment, the target resolver is determined to be a non-open resolver; if the target resolver is a non-open resolver, a host deployed within a response address range of the non-open resolver is selected as a target client; if the target resolver is an open resolver, a host deployed on any host that can connect to a public network is selected as a target client.

[0008] In one possible implementation, after determining that the target resolver is an open resolver, it also includes: querying the target resolver IP from different geographical locations, and receiving response results returned by the target resolver; if the response results come from different server IPs, it is determined that the target resolver uses the anycast technology; if the target resolver uses the anycast technology, any host deployed on the public network is selected as the target client, and the target client is connected to a proxy network with a wide geographical distribution.

[0009] In a possible implementation, after determining that the target resolver uses the anycast technology, the method further includes: if the target resolver uses the anycast technology, deploying multiple hosts that can connect to the public network in multiple different geographical locations; and determining all hosts as target clients.

[0010] In one possible implementation, based on preset rules, a subdomain name for a target resolver is generated according to the target resolver IP, including: representing the target resolver IP in hexadecimal to generate a hexadecimal expression; generating a timestamp according to a preset execution detection time; using a random number generator to generate a random suffix of a preset number of bits; and concatenating the hexadecimal expression, the timestamp, and the random suffix in a preset order to determine the subdomain name for the target resolver.

[0011] In a second aspect, an embodiment of the present application provides an egress parser identification device, applied to a computer device, including:

[0012] The address acquisition module is used to obtain the network protocol address IP of the target parser.

[0013] The target client determination module is used to send a preset domain name query request to a target resolver from multiple different network environments, and determine the target client according to the response of the target resolver.

[0014] The subdomain generation module is used to generate a subdomain for the target resolver based on the target resolver IP based on preset rules.

[0015] The first detection domain name determination module is used to concatenate the subdomain name with the first root domain name to determine the first detection domain name of the target resolver, wherein all subdomain names of the first root domain name can be normally resolved on the first server and return a first preset resolution result.

[0016] The request control module is used to control the target client to send a resolution request for the first detection domain name to the target resolver, so that the target resolver sends a request data packet to the first server.

[0017] The data packet screening module is used to receive all response data packets sent by the first server, and screen all response data packets according to the first detection domain name and the first preset resolution result to obtain a first target data packet.

[0018] The preferred egress set screening module is used to obtain the source IP addresses of all resolution requests from the first target data packet to obtain a preferred egress IP set.

[0019] The preferred egress resolver determination module is used to determine the service corresponding to the preferred egress IP set as the preferred egress resolver.

[0020] In a third aspect, an embodiment of the present application provides a computer device, including: a memory, a processor;

[0021] Memory stores computer-executable instructions;

[0022] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above first aspect and / or various possible implementations of the first aspect.

[0023] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementations of the first aspect.

[0024] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementation methods of the first aspect.

[0025] The exit resolver identification method, apparatus, device, storage medium and product provided in the embodiments of the present application can accurately identify each exit resolver of the target resolver by embedding the IP of the target resolver into the detection domain name; by setting the first server to normally resolve all subdomains of the first root domain name and return a specific first preset resolution result, it can accurately identify the preferred exit resolver of the target resolver, and comprehensively identify the entry resolver and exit resolver involved in the target resolver in the DNS resolution path, which can also reduce potential security risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0027] Figure 1 A schematic diagram of a scenario of an egress parser identification method provided in this application;

[0028] Figure 2 A flow chart of the method for identifying an egress parser provided in this application;

[0029] Figure 3 A schematic diagram of the structure of an exit parser identification device provided in an embodiment of the present application;

[0030] Figure 4 A schematic diagram of the structure of a computer device provided in an embodiment of the present application.

[0031] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0032] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0033] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in one or more embodiments of this specification are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards, and corresponding operation entrances shall be provided for users to choose to authorize or refuse.

[0034] First, the terms involved in this application are explained:

[0035] Anycast technology generally refers to a flexible media content distribution technology that allows users to access and play content at any time and any place.

[0036] In order to clearly understand the technical solution of the present application, the solution of the prior art is first introduced in detail. In the DNS resolution process, the recursive resolver receives the client's request and interacts with the authoritative server, but in fact the so-called recursive resolver may be composed of multiple resolvers. The resolver that communicates directly with the client is the entry resolver, and the resolver that communicates with the authoritative name server is the exit resolver. The entry resolver and the exit resolver can be the same, that is, the IP address is the same, but in some cases, the entry resolver and the exit resolver are different. For example, large resolution platforms usually use different resolvers to receive user requests and perform iterative resolution. In the prior art, DNS detection technology mainly focuses on identifying the initial entry for resolving IU, but it is unable to identify other servers passing through the network, which makes it difficult to fully understand the complete path of DNS resolution, thereby ignoring potential security risks.

[0037] In response to the above technical problems, the inventors have come up with the idea of ​​first sending a query request for a preset domain name to a target resolver from multiple different network environments, determining a target client for detecting the target resolver based on the response of the target resolver, and embedding the network protocol address IP of the target resolver into a subdomain for the target resolver based on preset rules, and splicing the subdomain with the pre-registered first root domain name to determine the first detection domain name of the target resolver, wherein the pre-registered first root domain name can be normally resolved on the first server and return the first preset resolution result. Control the target client to send a resolution request for the first detection domain name to the target resolver, and the target resolver sends a request data packet to the first server after receiving the request from the target client, receives all response data packets sent by the first server, and screens all response data packets according to the first detection domain name and the first preset resolution result to obtain a first target data packet, obtain the source IP in all resolution requests in the first target data packet, and obtain the IP set of all preferred export resolution services of the target resolver, and determine the service corresponding to the IP set as the preferred export resolver. By embedding the IP of the target resolver into the detection domain name, each exit resolver of the target resolver can be accurately identified; by setting the first server to normally resolve all subdomains of the first root domain name and return a specific first preset resolution result, the preferred exit resolver of the target resolver can be accurately identified, and the entry resolvers and exit resolvers involved in the target resolver can be fully identified in the DNS resolution path, which can also reduce potential security risks.

[0038] Based on the above creative findings, the inventor proposed the technical solution of the present application.

[0039] Figure 1 This is a schematic diagram of the scenario of the egress parser identification method provided in this application. Figure 1 As shown, the specific application scenario of the present application includes a target client 101, a target parser 102, a first server 103, a second server 104 and a computer device 105.

[0040] Specifically, the computer device 105 obtains the network protocol address IP of the target resolver 102, and sends a query request of a preset domain name to the target resolver 102 from multiple different network environments, and determines the target client 101 according to the response of the target resolver 102. The computer device 105 generates a subdomain name for the target resolver 102 according to the target resolver IP based on preset rules, splices the subdomain name with the first root domain name, and determines the first detection subdomain name of the target resolver. The first detection subdomain name can be normally resolved on the first server 103 and return a first preset resolution result. The computer device 105 controls the target client 101 to send a resolution request for the first detection domain name to the target resolver 102. The target resolver 102 sends a request data packet to the first server 103. After receiving the request data packet, the first server performs resolution and generates a response data packet. The computer device 105 receives all response data packets sent by the first server 103, and filters all response data packets according to the first detection domain name and the first preset resolution result to obtain a first target data packet. The source IPs of all resolution requests are obtained from the first target data packet to obtain a preferred egress IP set, and the service corresponding to the preferred egress IP set is determined as a preferred egress resolver.

[0041] Specifically, the computer device 105 concatenates the subdomain name with the second root domain name, determines the second detection subdomain name of the target resolver, and the second detection subdomain name can be resolved on the second server 104 and returns the second preset resolution result. The computer device 105 controls the target client 101 to send a resolution request for the second detection domain name to the target resolver, and the target resolver 102 sends a request data packet to the second server 104. After receiving the request data packet, the second server performs resolution and generates a response data packet. The computer device 105 receives all response data packets sent by the second server 104, and screens all response data packets according to the second detection domain name and the second preset resolution result to obtain the second target data packet. All source IPs of all resolution requests are obtained from the second data packet, all source IPs are traversed, and a preferred export IP set is proposed to obtain an alternative export IP set, and the service corresponding to the alternative export IP set is determined as an alternative export resolver.

[0042] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0043] Figure 2 This is a flow chart of the export parser identification method provided by this application. Figure 2 As shown, the method includes:

[0044] S201: Obtain the network protocol address IP of the target parser.

[0045] Specifically, the target server address currently in use is viewed through the network device interface to obtain the network protocol address IP of the target resolver.

[0046] S202: Sending a preset domain name query request to a target resolver from a plurality of different network environments, and determining a target client according to a response of the target resolver.

[0047] Specifically, the process of determining the target client includes Sa1~Sa6:

[0048] Sa1: Sending a preset domain name request from a plurality of different network environments to a target resolver, wherein the plurality of different network environments at least include a home network, an enterprise network, and a public network.

[0049] Specifically, domain name query requests for the same preset domain name are sent from different network environments such as home network, enterprise network and public network to test the response behavior of the target resolver under different network conditions.

[0050] Sa2: Receive the return result of the target parser.

[0051] Specifically, the target resolver's return results for each domain name query request are monitored and received. These return results usually include resolved IP addresses or other DNS records.

[0052] Sa3: If the target resolver returns valid DNS records, the target resolver is determined to be an open resolver.

[0053] An open resolver means that the resolver provides resolution services for requests from any network environment and usually does not set access restrictions.

[0054] Specifically, if the target resolver returns valid DNS records in all network environments, the target resolver is determined to be an open resolver.

[0055] Sa4: If the target resolver returns valid DNS records only in a specific network environment, the target resolver is determined to be a non-open resolver.

[0056] Among them, a non-open resolver means that the resolver may only be open to a specific network or user group and has access control or restrictions.

[0057] Specifically, if the target resolver returns valid DNS records only in a specific network environment, the target resolver is determined to be a non-open resolver.

[0058] Sa5: If the target resolver is a non-open resolver, a host deployed in the non-open resolver response address range is selected as the target client.

[0059] Specifically, if the target resolver is determined to be a non-open resolver, a host deployed within the response address range of the non-open resolver is selected as the target client. At this time, the target client is located within a specific network range.

[0060] Sa6: If the target resolver is an open resolver, select any host deployed on the public network as the target client.

[0061] Specifically, if the target resolver is determined to be an open resolver, any host that can connect to a public network is selected as a target client, so that the target client can be any device that can access a public network.

[0062] Specifically, for an open resolver using the anycast technology, the deployment of the target client further includes steps Sb1 to Sb3:

[0063] Sb1: Query the target resolver IP from different geographical locations and receive the response results returned by the target resolver.

[0064] Specifically, a domain name query request is initiated to a target resolver on different servers or proxy nodes around the world, and a response result is received from the target resolver, wherein the response result usually includes a resolved IP address or other DNS records.

[0065] Sb2: If the response results come from different server IPs, it is determined that the target resolver uses anycast technology.

[0066] Among them, anycast technology allows multiple servers to share one IP address, and the network will direct the request to the nearest or optimal server based on the routing protocol.

[0067] Specifically, the response results received from different geographical locations are analyzed. If these response results come from different server IP addresses, it can be determined that the target resolver uses the anycast technology.

[0068] Sb3: If the target resolver uses anycast technology, select any host that can connect to the public network as the target client, and connect the target client to a geographically distributed proxy network.

[0069] Specifically, if the target resolver is determined to use the anycast technology, any host that can connect to the public network is selected as the target client, and the target client is connected to a proxy network that is widely distributed geographically.

[0070] Specifically, for a target parser using the anycast technology, the deployment method of the target client further includes steps Sc1 and Sc2:

[0071] Sc1: If the target resolver uses anycast technology, deploy multiple hosts that can connect to the public network in multiple different geographical locations.

[0072] Specifically, by deploying target clients in multiple different geographical locations, it can be ensured that each target client can communicate efficiently with the anycast target resolver.

[0073] Sc2: Identify all hosts as target clients.

[0074] S203: Based on preset rules, generate a subdomain for the target resolver according to the target resolver IP.

[0075] Specifically, the process of generating the subdomain name of the target resolver includes steps Sd1 to Sd4:

[0076] Sd1: Represent the target parser IP in hexadecimal to generate a hexadecimal expression.

[0077] Specifically, convert each decimal portion of the target resolver IP to hexadecimal and then combine them together.

[0078] For example, assuming that the target resolver IP is 192.168.1.1, the process of converting each decimal part into hexadecimal is: convert 192 into hexadecimal 'C0'; convert 168 into hexadecimal 'A8'; convert 1 into hexadecimal '01'; convert 1 into hexadecimal '01', and combine these hexadecimals together into 'C0A80101', so the hexadecimal expression generated by the target resolver IP conversion is 'C0A80101'.

[0079] Sd2: Generates a timestamp based on the preset execution detection time.

[0080] Specifically, a preset execution detection time is determined, and based on the preset execution detection time, the system automatically generates a corresponding timestamp.

[0081] Sd3: Use the random number generator to generate a random suffix of a preset number of digits.

[0082] Specifically, a random number generator is used to create a random suffix. The random number generator may be a pseudo-random number generator or a true random number generator. According to requirements, a random suffix with a preset number of digits is generated, wherein the random suffix may be a number, a letter, or a combination of the two.

[0083] Sd4: Concatenates the hexadecimal expression, timestamp, and random suffix in a preset order to determine the subdomain for the target resolver.

[0084] Specifically, the hexadecimal expression, the timestamp, and the random suffix are concatenated in a preset order to generate a complete subdomain name.

[0085] S204: Concatenate the subdomain name with the first root domain name to determine a first detection domain name of the target resolver, wherein all subdomain names of the first root domain name can be normally resolved on the first server and return a first preset resolution result.

[0086] Specifically, first register a first root domain name. For example, assume that the first root domain name is noerror.com, and deploy a first server A with a public network IP. The address of the first server A is IP a , set the authoritative server of noerror.com to IP a , and deploy the resolution program on the first server A, and configure records for all subdomains of noerror.com by configuring wildcard records, so that all subdomains of noerror.com can be resolved normally. Through log settings, the domain names of all DNS requests received and the source IP addresses of the DNS request packets are recorded at the first server A.

[0087] The wildcard record configuration is as follows: *.noerror.com A 1.2.3.4, which means that all subdomains of noerror.com can be resolved to the address 1.2.3.4. In this way, any subdomain that is not explicitly configured will be resolved to the 1.2.3.4 wildcard record.

[0088] S205: Control the target client to send a resolution request for the first detection domain name to the target resolver, so that the target resolver sends a request data packet to the first server.

[0089] For example, assuming that the detection domain name is sub.noerror.com, where sub is a subdomain name, the target client is controlled to send a resolution request for sub.noerror.com to the target resolver. When the target resolver sends the resolution request to the first server A, a request data packet is constructed. This data packet complies with the DNS protocol specification and usually uses the UDP protocol.

[0090] S206: Receive all response data packets sent by the first server, and filter all response data packets according to the first detection domain name and the first preset resolution result to obtain a first target data packet.

[0091] Specifically, a network monitoring tool is used to capture outbound requests on the target resolver to observe whether it sends a request to the first server. When it is determined that the target resolver sends a request to the first server, all response data packets in the first server are obtained, and all response data packets are screened according to the first detection domain name and the preset resolution result 1.2.3.4 to obtain the first target data packet.

[0092] S207: Obtain the source IPs of all resolution requests from the first target data packet to obtain a preferred egress IP set.

[0093] The preferred egress IP set represents the IP addresses of all node devices that initiate resolution requests in the current network environment.

[0094] Specifically, a protocol analysis tool or library is used to read the structure and content of the first target data packet, and all source IP addresses are extracted from the parsed request, where the source IP refers to the IP address of the client device that initiates the request. All the extracted source IP addresses are aggregated to form a preferred egress IP set.

[0095] S208: Determine the service corresponding to the preferred egress IP set as the preferred egress resolver.

[0096] Specifically, the DNS resolution service corresponding to the preferred egress IP set is determined as the preferred egress resolver.

[0097] In summary, by embedding the IP of the target resolver into the detection domain name, each exit resolver of the target resolver can be accurately identified; by setting the first server to normally resolve all subdomains of the first root domain name and return a specific first preset resolution result, the preferred exit resolver of the target resolver can be accurately identified, and the entry resolvers and exit resolvers involved in the target resolver can be fully identified in the DNS resolution path, which can also reduce potential security risks.

[0098] In addition, the use of a proxy network enables identification of the export server of the target resolver using anycast technology.

[0099] In another embodiment of the present application, the target parser has an alternative egress parser in addition to the preferred egress parser, which is used for redundancy and failover support when the preferred egress parser is unavailable or performs poorly. The identification process of the alternative egress parser includes:

[0100] S301: Concatenate the subdomain name with the second root domain name to determine a second detection domain name of the target resolver, wherein all subdomain names of the second root domain name are resolved on a second server and a second preset resolution result is returned.

[0101] Specifically, first register a second root domain name. For example, assume that the second root domain name is servfail.com, and deploy a second server B with a public network IP. The address of the second server B is IP b , set the authoritative server of servfail.com to IP b , and deploy the resolution response program on the second server B, so that all resolution requests for servfail.com will get the resolution result with the response status of servfail. Through the log setting, the domain name of all DNS requests received and the source IP of the DNS request data packet are recorded at the second server B.

[0102] S302: Control the target client to send a resolution request for the second detection domain name to the target resolver, so that the target client sends a request data packet to the second server.

[0103] For example, assuming that the detection domain name is sub.servfail.com, where sub is a subdomain name, the target client is controlled to send a resolution request for sub.servfail.com to the target resolver. When the target resolver sends the resolution request to the second server B, a request data packet is constructed. This data packet complies with the DNS protocol specification and usually uses the UDP protocol.

[0104] S303: accept all response data packets sent by the second server, and screen all response data packets according to the second detection domain name and the second preset resolution result to obtain a second target data packet.

[0105] Specifically, a network monitoring tool is used to capture outbound requests on the target resolver to observe whether it sends a request to the second server. When it is determined that the target resolver sends a request to the second server, all response data packets in the second server are obtained, and all response data packets are screened according to the second detection domain name and the preset resolution result servfail to obtain the second target data packet.

[0106] S304: Obtain all source IP addresses of all resolution requests from the second target data packet.

[0107] Specifically, a protocol analysis tool or library is used to read the structure and content in the second target data packet, and all source IP addresses are extracted from the parsing request, where the source IP refers to the IP address of the client device that initiates the request. All the extracted source IP addresses are aggregated to form a set of all egress IP addresses.

[0108] S305: Traverse all source IPs, remove the preferred egress IP set, and obtain the candidate egress IP set.

[0109] Specifically, all egress IP sets are traversed, and the previously obtained preferred egress IP set is deleted, and the remaining IP sets are the candidate egress IP sets.

[0110] S306: Determine the service corresponding to the candidate egress IP set as the candidate egress resolver.

[0111] Specifically, the DNS resolution service corresponding to the candidate egress IP set is determined as the candidate egress resolver.

[0112] In summary, by setting different resolution response results for the first root domain name and the second root domain name, for the second detection domain name, the target resolver will first send a resolution request to the second server through the preferred export resolver. After no IP response is received, the backup export resolver is enabled to send a resolution request to the second server. Therefore, the IPs of all export resolvers can be determined through the response request data packet on the second server, and the preferred export resolver can be proposed. All alternative export resolvers of the target resolver can be identified, making the identification effect of the target resolver more comprehensive.

[0113] Figure 3 A structural diagram of an export resolver identification device provided in an embodiment of the present application, the device includes an address acquisition module 301, a target client determination module 302, a subdomain generation module 303, a first detection domain name determination module 304, a request control module 305, a data packet screening module 306, a preferred export set screening module 307 and a preferred export resolver determination module 308.

[0114] The address acquisition module 301 is used to acquire the network protocol address IP of the target parser.

[0115] The target client determination module 302 is used to send a preset domain name query request to a target resolver from a plurality of different network environments, and determine a target client according to a response of the target resolver.

[0116] The subdomain generation module 303 is used to generate a subdomain for the target resolver according to the target resolver IP based on preset rules.

[0117] The first detection domain name determination module 304 is used to concatenate the subdomain name with the first root domain name to determine the first detection domain name of the target resolver, wherein all subdomain names of the first root domain name can be normally resolved on the first server and return a first preset resolution result.

[0118] The request control module 305 is used to control the target client to send a resolution request for the first detection domain name to the target resolver, so that the target resolver sends a request data packet to the first server.

[0119] The data packet screening module 306 is used to receive all response data packets sent by the first server, and screen all response data packets according to the first detection domain name and the first preset resolution result to obtain a first target data packet.

[0120] The preferred egress set screening module 307 is used to obtain the source IP addresses of all resolution requests from the first target data packet to obtain a preferred egress IP set.

[0121] The preferred egress resolver determination module 308 is used to determine the service corresponding to the preferred egress IP set as the preferred egress resolver.

[0122] In one possible implementation, the device also includes an alternative export resolver determination module, which is used to concatenate the subdomain name with the second root domain name to determine the second detection domain name of the target resolver, wherein all subdomain names of the second root domain name are resolved on the second server and return a second preset resolution result; control the target client to send a resolution request for the second detection domain name to the target resolver, so that the target client sends a request data packet to the second server; accept all response data packets sent by the second server, and filter all response data packets according to the second detection domain name and the second preset resolution result to obtain a second target data packet; obtain all source IPs of all resolution requests from the second target data packet; traverse all source IPs, eliminate the preferred export IP set, and obtain an alternative export IP set; determine the service corresponding to the alternative export IP set as the alternative export resolver.

[0123] In a possible implementation, the target client determination module 302 is specifically used to send a preset domain name request from multiple different network environments to a target resolver, wherein the multiple different network environments include at least a home network, an enterprise network, and a public network; receive a return result from the target resolver; if the target resolver returns valid domain name system records, the target resolver is determined to be an open resolver; if the target resolver only returns valid domain name system records in a specific network environment, the target resolver is determined to be a non-open resolver; if the target resolver is a non-open resolver, a host deployed in a response address range of the non-open resolver is selected as the target client; if the target resolver is an open resolver, any host deployed that can connect to a public network is selected as the target client.

[0124] In one possible implementation, the target client determination module 302 is further specifically used to query the target resolver IP from different geographical locations and receive the response results returned by the target resolver; if the response results come from different server IPs, it is determined that the target resolver uses the anycast technology; if the target resolver uses the anycast technology, any host deployed on the public network that can be connected to the public network is selected as the target client, and the target client is connected to a proxy network with a wide geographical distribution.

[0125] In a possible implementation, the target client determination module 302 is further specifically used to deploy multiple hosts that can connect to the public network in multiple different geographical locations if the target resolver uses anycast technology; and determine all hosts as target clients.

[0126] In one possible implementation, the subdomain generation module 303 is specifically used to represent the target resolver IP in hexadecimal to generate a hexadecimal expression; generate a timestamp according to a preset execution detection time; use a random number generator to generate a random suffix of a preset number of bits; and concatenate the hexadecimal expression, timestamp and random suffix in a preset order to determine the subdomain for the target resolver.

[0127] The egress parser identification device provided in this embodiment can execute the method provided in the above method embodiment, and its implementation principle and technical effect are similar, which will not be described in detail in this embodiment.

[0128] Figure 4 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present application. Figure 4 As shown, the computer device provided in this embodiment includes: at least one processor 401 and a memory 402. Optionally, the computer device also includes a communication component 403. The processor 401, the memory 402 and the communication component 403 are connected via a bus 404.

[0129] In a specific implementation process, at least one processor 401 executes the computer-executable instructions stored in the memory 402, so that at least one processor 401 executes the above method.

[0130] The specific implementation process of the processor 401 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0131] In the above embodiments, it should be understood that the processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the invention can be directly implemented as a hardware processor, or can be implemented by a combination of hardware and software modules in the processor.

[0132] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (NVM), such as at least one disk storage.

[0133] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of this application is not limited to only one bus or one type of bus.

[0134] An embodiment of the present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0135] An embodiment of the present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0136] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0137] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0138] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0139] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0140] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0141] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0142] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0143] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A method for identifying an export parser, characterized in that: Applicable to computer equipment, including: Get the network protocol address IP of the target parser; Sending a preset domain name query request to the target resolver from a plurality of different network environments, and determining a target client according to a response of the target resolver; Based on preset rules, generate a subdomain for the target resolver according to the target resolver IP; The subdomain name is concatenated with the first root domain name to determine a first detection domain name of the target resolver, wherein all subdomain names of the first root domain name can be normally resolved on the first server and return a first preset resolution result; Controlling the target client to send a resolution request for the first detection domain name to the target resolver, so that the target resolver sends a request data packet to the first server; receiving all response data packets sent by the first server, and screening all the response data packets according to the first detection domain name and the first preset resolution result to obtain a first target data packet; Obtaining source IPs of all resolution requests from the first target data packet to obtain a preferred egress IP set; The service corresponding to the preferred egress IP set is determined as the preferred egress resolver.

2. The method according to claim 1, characterized in that Also includes: The subdomain name is concatenated with the second root domain name to determine a second detection domain name of the target resolver, wherein all subdomain names of the second root domain name are resolved on the second server and a second preset resolution result is returned; Controlling the target client to send a resolution request for the second detection domain name to the target resolver, so that the target client sends a request data packet to the second server; Accepting all response data packets sent by the second server, and screening all the response data packets according to the second detection domain name and the second preset resolution result to obtain a second target data packet; Obtain all source IP addresses of all resolution requests from the second target data packet; Traverse all the source IPs, remove the preferred egress IP set, and obtain the candidate egress IP set; The service corresponding to the candidate egress IP set is determined as the candidate egress resolver.

3. The method according to claim 1, characterized in that: The sending of a preset domain name query request to the target resolver from a plurality of different network environments, and determining a target client according to a response of the target resolver, includes: Sending a preset domain name request from a plurality of different network environments to the target resolver, wherein the plurality of different network environments at least include a home network, an enterprise network, and a public network; Receive the return result of the target parser; If the target resolvers all return valid DNS records, the target resolvers are determined to be open resolvers; If the target resolver returns valid DNS records only in a specific network environment, determining that the target resolver is a non-open resolver; If the target resolver is a non-open resolver, a host deployed in the response address range of the non-open resolver is selected as the target client; If the target resolver is an open resolver, any host that can be connected to a public network is selected as the target client.

4. The method according to claim 3, characterized in that After determining that the target parser is an open parser, the method further includes: Querying the target resolver IP from different geographical locations and receiving a response result returned by the target resolver; If the response results come from different server IPs, it is determined that the target resolver uses anycast technology; If the target resolver uses anycast technology, any host that can connect to the public network is selected as the target client, and the target client is connected to a proxy network with a wide geographical distribution.

5. The method according to claim 4, characterized in that After determining that the target parser uses the anycast technology, the method further includes: If the target resolver uses anycast technology, multiple hosts capable of connecting to a public network are deployed in multiple geographical locations; All hosts are determined as the target clients.

6. The method according to claim 1, characterized in that The generating a subdomain for the target resolver according to the target resolver IP based on the preset rule includes: Representing the target parser IP in hexadecimal to generate a hexadecimal expression; Generate a timestamp based on the preset execution detection time; Generate a random suffix of preset digits using a random number generator; The hexadecimal expression, the timestamp, and the random suffix are concatenated in a preset order to determine the subdomain name for the target resolver.

7. An exit parser identification device, characterized in that: Applicable to computer equipment, including: An address acquisition module is used to obtain the network protocol address IP of the target resolver; A target client determination module, used to send a preset domain name query request to the target resolver from a plurality of different network environments, and determine a target client according to a response of the target resolver; A subdomain generation module, used to generate a subdomain for the target resolver according to the target resolver IP based on preset rules; A first detection domain name determination module is used to concatenate the subdomain name with the first root domain name to determine the first detection domain name of the target resolver, wherein all subdomain names of the first root domain name can be normally resolved on the first server and return a first preset resolution result; a request control module, configured to control the target client to send a resolution request for the first detection domain name to the target resolver, so that the target resolver sends a request data packet to the first server; a data packet screening module, configured to receive all response data packets sent by the first server, and screen all the response data packets according to the first detection domain name and the first preset resolution result to obtain a first target data packet; A preferred egress set screening module, used to obtain source IP addresses of all resolution requests from the first target data packet to obtain a preferred egress IP set; The preferred egress resolver determination module is used to determine the service corresponding to the preferred egress IP set as the preferred egress resolver.

8. A computer device, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 6 when executed by a processor.

10. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 6 when being executed by a processor.

Images