IP address identification method and device of CDN source station, and storage medium

Abstract

The invention provides an IP address identification method and device of a CDN source station and a storage medium, and the method comprises the steps: collecting a user Internet log, and building a DNS record database based on the Internet log; establishing a CDN domain name feature library based on the DNS record database; establishing a chain table during domain name resolution based on the CDN domain name feature library; determining a target IP address and a candidate IP address of the target domain name based on a CDN domain name feature library and a domain name resolution chain table; and determining page similarity corresponding to the target IP address and the candidate IP address, and determining the candidate IP address corresponding to the page similarity meeting a first threshold condition as the real IP address of the target domain name. Therefore, the real IP address of the target domain name is determined through the CDN domain name feature library and the page similarity corresponding to the target IP address and the candidate IP address, the domain name features do not need to be assumed, the accuracy of the CDN domain name is improved, a server does not need to be deployed, and the cost is reduced.

Description

Technical Field

[0001] The present disclosure relates to the field of information security technology, and in particular to a method, device and storage medium for identifying an IP address of a CDN source station. Background Art

[0002] With the explosive growth of Internet users, more and more Internet service providers use CDN (Content Delivery Network) services to achieve social and economic benefits. However, while CDN services are widely used, there are also cases where CDN (Content Delivery Network) technology is used to hide the real IP address of the source station, making it impossible to effectively supervise illegal and non-compliant websites on CDN. Based on this, it is necessary to identify the IP address of the CDN source station to provide strong support for subsequent tracking and locating websites.

[0003] In the prior art, a variety of CDN identification attributes can be used and analyzed through a CDN classifier formed by the Naive Bayes principle, so that a site will not be misjudged because it does not have a certain feature. However, the Naive Bayes classifier assumes that all features are independent, but in the actual network environment, there may be correlations between various CDN identification attributes. Based on this, the non-compliance of the above assumptions may lead to deviations in the classification results and reduce the accuracy of the detection. Alternatively, the source station is mined based on the off-site Ping technology, but this method depends on the geographical coverage and configuration of the CDN. If the CDN manufacturer has also deployed nodes abroad, the Ping test may resolve to the IP of the CDN node instead of the real source station IP, making it impossible to identify the real source station, and in order to effectively perform off-site Ping tests, servers need to be deployed in multiple geographical locations, which increases the complexity and cost of deployment and maintenance. Summary of the invention

[0004] In order to overcome the problems existing in the related art, the present disclosure provides a method, device and storage medium for identifying the IP address of a CDN source station.

[0005] According to a first aspect of an embodiment of the present disclosure, a method for identifying an IP address of a CDN source station is provided, the method comprising:

[0006] Collect user online logs and establish a DNS record database based on the online logs;

[0007] Based on the DNS record database, a CDN domain name feature database is established;

[0008] Based on the CDN domain name feature library, a domain name resolution link table is established;

[0009] Determine the target IP address and candidate IP addresses of the target domain name based on the CDN domain name feature library and the domain name resolution chain table;

[0010] The page similarity corresponding to the target IP address and the candidate IP address is determined, and the candidate IP address corresponding to the page similarity that meets the first threshold condition is determined as the real IP address of the target domain name.

[0011] Optionally, in the embodiment of the present disclosure, collecting user online logs and establishing a DNS record database based on the online logs includes:

[0012] Collecting the user's online logs through a probe device;

[0013] Parsing the DNS protocol in the Internet access log and extracting key information;

[0014] Based on the key information, a DNS record database is established.

[0015] Optionally, in an embodiment of the present disclosure, the CDN domain name feature database includes a DNSRecord data table; and establishing the CDN domain name feature database based on the DNS record database includes:

[0016] Traverse the CNAME list field in the DNSRecord table to build a corresponding domain name multi-branch tree;

[0017] Determine a target subdomain name and a parent domain name of the target subdomain name in the domain name multi-branch tree;

[0018] Traverse the DNSRecord table to obtain a list of domain names in the CNAME list that jump to the parent domain name;

[0019] Based on the domain name list, a CDN domain name feature library is established.

[0020] Optionally, in the embodiment of the present disclosure, establishing a CDN domain name feature library based on the domain name list includes:

[0021] Determining whether the length of the domain name list meets a second threshold condition;

[0022] If the length of the domain name list meets the second threshold condition, clustering the domain names in the domain name list to obtain a clustering result;

[0023] If the number of clusters in the clustering result does not meet the third threshold condition, then calculating the average entropy value of all subdomain character strings in the domain name list;

[0024] If the average value satisfies a fourth threshold condition, establishing a CDN domain name feature library based on the subdomain name;

[0025] If the average value does not meet the fourth threshold condition, a CDN domain name feature library is established based on the pattern and keywords of the subdomain name character string.

[0026] Optionally, in the embodiment of the present disclosure, clustering the domain names in the domain name list to obtain clustering results includes:

[0027] Traverse the domain name list and construct a domain name list matrix;

[0028] The domain name list matrix is ​​used as the input of DBSCAN, and clustering is performed through DBSCAN to obtain a clustering result.

[0029] Optionally, in an embodiment of the present disclosure, the CDN domain name feature library includes a DNSRecord data table; and establishing a domain name resolution linked list based on the CDN domain name feature library includes:

[0030] The DNSRecord table is traversed, and a time-series bidirectional linked list is established based on the time of resolution of the domain name field in the DNSRecord table, wherein each node in the time-series bidirectional linked list includes a CNAME list field and an IP list field.

[0031] Optionally, in the embodiment of the present disclosure, determining the target IP address and candidate IP address of the target domain name based on the CDN domain name feature library and the domain name resolution link list includes:

[0032] Determine the hash value of the target domain name;

[0033] Determine a target domain name resolution linked list of the target domain name based on the hash value of the target domain name;

[0034] Determine whether the CNAME list field in the latest node of the linked list during the resolution of the target domain name hits the feature in the CDN domain name feature library;

[0035] If the CNAME list field in the latest node hits the feature in the CDN domain name feature library, determining the target IP address of the target domain name based on the IP list field in the latest node;

[0036] The target domain name resolution linked list is traversed to determine the candidate nodes and the candidate IP addresses of the target domain name.

[0037] Optionally, in the embodiment of the present disclosure, determining the page similarity corresponding to the target IP address and the candidate IP address, and determining the candidate IP address corresponding to the page similarity that satisfies the first threshold condition as the real IP address of the target domain name includes:

[0038] Extracting a first page DOM frame of the target IP address and a second page DOM frame of the candidate IP address;

[0039] Determine page similarity between the first page DOM framework and the second page DOM framework based on the tree edit distance;

[0040] If the page similarity satisfies a first threshold condition, determining the candidate IP address corresponding to the page similarity as the real IP address of the target domain name;

[0041] If the page similarity does not meet the first threshold condition, the candidate IP address of the target domain name will be re-determined, and the above steps will be repeated until the real IP address of the target domain name is determined or the linked list traversal is completed when the target domain name corresponding to the target domain name is resolved.

[0042] Optionally, in the embodiment of the present disclosure, the method further includes:

[0043] Add the target domain name and the IP list field in the candidate node of the target domain name to the domain name tracing information base;

[0044] Based on the domain name tracing information database, the real IP address of the CDN source station is determined.

[0045] Optionally, in the embodiment of the present disclosure, before establishing the domain name resolution link list based on the CDN domain name feature library, the method further includes:

[0046] Filter the domain names in the CDN domain name feature library through a domain name whitelist to obtain filtered domain names;

[0047] Based on the filtered domain names, a domain name resolution linked list is established.

[0048] According to a second aspect of an embodiment of the present disclosure, a device for identifying an IP address of a CDN source station is provided, wherein the device comprises:

[0049] A first establishment module is used to collect user online logs and establish a DNS record database based on the online logs;

[0050] A second establishing module is used to establish a CDN domain name feature library based on the DNS record database;

[0051] A third establishment module is used to establish a domain name resolution link list based on the CDN domain name feature library;

[0052] A first determination module, configured to determine a target IP address and candidate IP addresses of a target domain name based on the CDN domain name feature library and the domain name resolution chain table;

[0053] The second determination module is used to determine the page similarity corresponding to the target IP address and the candidate IP address, and determine the candidate IP address corresponding to the page similarity that meets the first threshold condition as the real IP address of the target domain name.

[0054] According to a third aspect of an embodiment of the present disclosure, there is provided an electronic device, including:

[0055] processor;

[0056] a memory for storing processor-executable instructions;

[0057] The processor is configured to implement the method described in the first aspect above.

[0058] According to a fourth aspect of an embodiment of the present disclosure, a non-temporary computer-readable storage medium is provided, wherein the computer storage medium stores computer-executable instructions; after the computer-executable instructions are executed by a processor, the method described in the first aspect above can be implemented.

[0059] The technical solution provided by the embodiments of the present disclosure may have the following beneficial effects:

[0060] The present disclosure proposes a method, device and storage medium for identifying the IP address of a CDN source station. The method includes collecting user Internet logs and establishing a DNS record database based on the Internet logs; establishing a CDN domain name feature library based on the DNS record database; establishing a domain name resolution link list based on the CDN domain name feature library; determining the target IP address and candidate IP address of the target domain name based on the CDN domain name feature library and the domain name resolution link list; determining the page similarity corresponding to the target IP address and the candidate IP address, and determining the candidate IP address corresponding to the page similarity that meets the first threshold condition as the real IP address of the target domain name. Therefore, the present disclosure can determine the real IP address of the target domain name through the CDN domain name feature library, the target IP address and the page similarity corresponding to the candidate IP address, without making assumptions about the domain name features, thereby improving the accuracy of the CDN domain name, and without deploying servers, thereby reducing costs.

[0061] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0063] Figure 1 It is a flowchart of a method for identifying an IP address of a CDN source station according to some embodiments of the present disclosure;

[0064] Figure 2 is a schematic diagram of DNS resolution according to some embodiments of the present disclosure;

[0065] Figure 3 is a schematic diagram of a domain name multi-branch tree according to some embodiments of the present disclosure;

[0066] Figure 4 is a schematic diagram of a time-series bidirectional linked list according to some embodiments of the present disclosure;

[0067] Figure 5 It is a structural schematic diagram of an IP address identification device of a CDN source station according to some embodiments of the present disclosure;

[0068] Figure 6 It is a block diagram of an electronic device suitable for executing the IP address identification method of a CDN source station according to some embodiments of the present disclosure. DETAILED DESCRIPTION

[0069] Some embodiments of the present disclosure will be described in detail here, and examples thereof are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. Various changes, modifications and equivalents of the methods, devices and / or systems described herein will become apparent after understanding the present disclosure. For example, the order of operations described herein is merely an example and is not limited to those orders set forth herein, but can be changed as becomes apparent after understanding the present disclosure, except for operations that must be performed in a specific order. In addition, for clarity and brevity, descriptions of features known in the art may be omitted.

[0070] The embodiments described in some embodiments of the present disclosure below do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0071] In current technology, it is possible to determine whether there is an IP address corresponding to the domain name in each DNS historical database based on each DNS historical database in the historical database list. When there is an IP address corresponding to the domain name, the IP address is determined as the IP address of the CDN source station. Among them, this method is simple and direct, and easy to implement. However, this method mainly relies on the records in the historical DNS database to identify the source station IP. Although it is simple and direct, it lacks fine-grained analysis of the data. There may be differences in DNS resolution records in different time periods and different geographical locations. If no detailed analysis is performed, some key details may be overlooked. In addition, this method does not further verify the IP address obtained from the historical DNS record, and directly determines it as the source station IP, which may lead to inaccurate identification results.

[0072] Figure 1 is a flow chart of a method for identifying an IP address of a CDN source station according to some embodiments of the present disclosure, such as Figure 1 As shown, the method may include the following steps:

[0073] Step 101: Collect user Internet access logs and establish a DNS record database based on the Internet access logs.

[0074] It should be noted that the executor of the above-mentioned CDN source station IP address identification method is the CDN source station IP address identification device, which can be implemented by software and / or hardware. The CDN source station IP address identification device in this embodiment can be configured in an electronic device.

[0075] In this example embodiment, the electronic device may include devices such as terminal devices and servers, and this embodiment does not limit the electronic device.

[0076] In the embodiment of the present disclosure, the method for collecting user online logs and establishing a DNS (Domain Name System) record database based on the online logs may include the following steps:

[0077] Step 1: Collect the user's Internet logs through the probe device;

[0078] Step 2: Analyze the DNS protocol in the Internet log and extract key information;

[0079] Step 3: Establish a DNS record database based on key information.

[0080] Among them, in the embodiment of the present disclosure, the user's Internet logs (such as HTTP requests and DNS queries) can be collected by deploying probe devices on the network interface (such as S1-U of 4G and N9 of 5G).

[0081] In the embodiment of the present disclosure, after collecting the user's online log through the above steps, the DNS protocol in the online log can be parsed, the key information of the DNS response can be extracted, and DNS XDR data can be established based on the key information, wherein the key information can include:

[0082] 1) Transaction ID: unique identifier of DNS session

[0083] 2) Query Name: The domain name being queried

[0084] 3) Query Type: Query type

[0085] 4)Response Code: DNS response code, indicating the query success or error type

[0086] 5)Answer: The resolved IP address or other data

[0087] 6) TTL: Record lifetime

[0088] 7) Timestamp: timestamp of query and response

[0089] 8) Client IP: The IP address of the user device that initiated the DNS query

[0090] 9) Server IP: The IP address of the server that handles the DNS query

[0091] In the disclosed embodiment, after obtaining the key information through the above steps, a DNS record database can be established based on the key information and according to preset rules. Among them, the CDN domain name feature library can include a DNSRecord data table, and the key fields of the DNSRecord data table can include: Query Name: the queried domain name; Answer: the resolved IP address or other data; CNAME list: redirected domain name list (there may be multiple jumps); IP list: A / AAAA record resolved IP address list (there may be multiple).

[0092] Among them, in the embodiment of the present disclosure, when a DNS query is initiated during the Internet access process, there may be a large number of repeated DNS query records for the same domain name. When scanning the DNS XDR data established based on the above-mentioned key information and establishing a DNS record database, it is necessary to preset rules to deduplicate the DNS XDR data, select the changed data for storage, and record the key information to save storage space.

[0093] Specifically, in the embodiments of the present disclosure, the above-mentioned preset rules may include:

[0094] Rule 1: Check if there is a record in the search table with the Query Name being the domain name. If not, insert a new record.

[0095] Rule 2: If a record already exists, determine whether there is a CNAME record in the Answer content in the XDR. If there is a CNAME record, compare the CNAME content in the Answer with the CNAME of the existing record to see if they are consistent. If they are consistent, do not insert a new record; otherwise, insert a new record based on the Answer content in the XDR.

[0096] Rule 3: If a record already exists, determine whether there is a CNAME record in the Answer content of the XDR. If no CNAME record exists, compare the IP (Internet Protocol) address list in the Answer to see if it is consistent with the IP List of the existing record. If they are consistent, do not insert a new record. Otherwise, insert a new record based on the Answer content of the XDR.

[0097] Furthermore, in the disclosed embodiment, the DNSRecord table is continuously updated according to the above preset rules to maintain a real-time DNS resolution record table as the data basis for later establishing the domain name resolution timing chain and the CDN domain name feature library.

[0098] Step 102: Establish a CDN domain name feature database based on the DNS record database.

[0099] In the disclosed embodiment, after the user purchases the acceleration service provided by a CDN service provider, the CDN service provider will provide a CNAME domain name for the website, which usually points to the DNS scheduling server of the CDN service provider. After the user receives the CNAME domain name, he needs to configure the DNS resolution on the website's domain name provider and point the CNAME record of the original domain name to the domain name. And, after the above configuration is completed and takes effect, when the user visits the website, in the DNS resolution link, the DNS scheduling server will perform load balancing based on the user's geographic location, return the optimal node IP in the DNS response, and route the user's request to the nearest CDN node to achieve the goal of acceleration.

[0100] For example, Figure 2 A schematic diagram of a DNS resolution provided by an embodiment of the present disclosure. Figure 2As shown in the figure, the CNAME domain name configured for the domain name zoscf.0qy2t0.cyou is df2eba67.guangcdn.com. After the user's DNS request enters the CDN scheduling portal, it may undergo multiple scheduling and jumps such as regional DNS scheduling. Finally, the IP addresses of the two CDN nodes used for load balancing (35.79.242.233 and 20.2.80.50) are returned to the user. After receiving the DNS query result, the user selects one of the IPs to establish an HTTP request.

[0101] Among them, in the embodiment of the present disclosure, the above-mentioned CDN server uses a subdomain name with a random string as the CNAME domain name of the scheduling entry, so that the subdomain name with the random string can disperse the user's requests to multiple servers to achieve load balancing, and the random string increases the difficulty of prediction, making it difficult for attackers to target specific CDN nodes for attack. At the same time, flexible DNS configuration and scheduling strategies are used to achieve failover and rapid response.

[0102] Furthermore, in the embodiment of the present disclosure, after obtaining the DNS record database through the above steps, a CDN domain name feature database can be established based on the DNS record database.

[0103] Specifically, in the embodiment of the present disclosure, the method for establishing a CDN domain name feature database based on a DNS record database may include the following steps:

[0104] Step 1021, traverse the CNAME (Canonical Name) list field in the DNSRecord table to build a corresponding domain name multi-branch tree;

[0105] Step 1022: Determine the target subdomain name and the parent domain name of the target subdomain name in the domain name multi-branch tree;

[0106] Step 1023, traverse the DNSRecord table to obtain a list of domain names that jump to the parent domain name in the CNAME list;

[0107] Step 1024: Establish a CDN domain name feature library based on the domain name list.

[0108] In the embodiment of the present disclosure, the CNAME list field in the DNSRecord table is traversed, and the CNAME domain name is segmented by the symbol "." to construct a domain name multi-branch tree. For example, Figure 3 A schematic diagram of a domain name multi-branch tree provided in an embodiment of the present disclosure.

[0109] And, in the embodiment of the present disclosure, after obtaining the domain name multi-branch tree through the above steps, the method for determining the target subdomain name in the domain name multi-branch tree and the parent domain name of the target subdomain name may include: determining the subdomain name whose number of brother leaf nodes in the domain name multi-branch tree exceeds a preset threshold as the target subdomain name in the domain name multi-branch tree, and extracting the parent domain name corresponding to the target subdomain name. Among them, the preset threshold can be set as needed, for example, 3.

[0110] Further, in the embodiment of the present disclosure, after determining the target subdomain name and the parent domain name of the target subdomain name through the above steps, the above DNSRecord table can be traversed to obtain the domain name list in the CNAME list that jumps to the parent domain name, and based on the domain name list, a CDN domain name feature library is established. For example, assuming that the parent domain name is guangcdn.com, the DNSRecord table is traversed to obtain the domain name list that jumps to *.guangcdn.com through CNAME.

[0111] Specifically, in the embodiment of the present disclosure, the method for establishing a CDN domain name feature library based on the domain name list may include the following steps:

[0112] Step 1: Determine whether the length of the domain name list meets the second threshold condition;

[0113] Step 2: If the length of the domain name list meets the second threshold condition, cluster the domain names in the domain name list to obtain a clustering result;

[0114] Step 3: If the number of clusters in the clustering result does not meet the third threshold condition, then the average entropy value of all subdomain strings in the domain name list is calculated;

[0115] Step 4: If the average value meets the fourth threshold condition, a CDN domain name feature library is established based on the subdomain name;

[0116] Step 5: If the average value does not meet the fourth threshold condition, a CDN domain name feature library is established based on the pattern and keywords of the subdomain name string.

[0117] In the embodiment of the present disclosure, the method for determining whether the length of the domain name list meets the second threshold condition may include: determining whether the length of the domain name list is greater than the second threshold, and if the length of the domain name list is greater than the second threshold, determining that the length of the domain name list meets the second threshold condition; if the length of the domain name list is less than or equal to the second threshold, determining that the length of the domain name list does not meet the second threshold condition. In the embodiment of the present disclosure, the second threshold can be set as needed, for example, 4.

[0118] In the embodiment of the present disclosure, if the length of the domain name list does not meet the second threshold condition, a CDN domain name feature library can be established based on the pattern and keywords of the subdomain name string. This part will be described in detail in subsequent embodiments.

[0119] And, in the embodiment of the present disclosure, if the length of the domain name list meets the second threshold condition, the domain names in the domain name list can be clustered to obtain a clustering result. Specifically, in the embodiment of the present disclosure, the above method of clustering the domain names in the domain name list to obtain a clustering result may include: traversing the domain name list, constructing a domain name list matrix, and using the domain name list matrix as an input of DBSCAN (Density-Based Spatial Clustering of Applications with Noise, a density-based spatial clustering method with noise), and performing clustering through DBSCAN to obtain a clustering result.

[0120] In the embodiment of the present disclosure, the method of traversing the domain name list and constructing the domain name list matrix may include: traversing the domain name list, calculating the domain name D i and D j The Levenshtein similarity between them is calculated, and the similarity value is filled into the domain name list matrix to establish the domain name list matrix.

[0121] In the embodiment of the present disclosure, the domain name D can be calculated by the first formula: i and D j The Levenshtein similarity between , where the first formula is:

[0122]

[0123] Among them, Levenshtein (D i ,D j ) is the domain name D i and D j Levenshtein distance, |D i | and |D j |Domain name D i and D j The character length of

[0124] For example, assuming that the length of the domain name list is L, the domain name D is obtained through the above steps. i and D j After the Levenshtein similarity between them, the obtained similarity is filled into the matrix M ij , we get the corresponding domain name list matrix M.

[0125] Furthermore, in the embodiment of the present disclosure, after obtaining the domain name list matrix M through the above steps, the domain name list matrix M can be used as the input of DBSCAN, and the noise is processed by DBSCAN and clustering is performed by density to obtain a clustering result.

[0126] Furthermore, in an embodiment of the present disclosure, before determining whether the number of clusters in the clustering result satisfies the third threshold condition, the above method may also include: calculating the silhouette coefficient of each point in the clustering result, and calculating the average silhouette coefficient of the clustering result, and adjusting the parameters in DBSCAN according to the result of the average silhouette coefficient, so as to optimize the clustering result.

[0127] In the embodiment of the present disclosure, the number of clusters in the clustering results obtained by the above steps reflects the number of different categories or groups in the domain name list. Based on this, the relevance in the domain name list can be determined based on the number of clusters in the clustering results. Specifically, in the embodiment of the present disclosure, if the number of clusters in the clustering results is greater than the third threshold, that is, the number of clusters in the clustering results meets the third threshold condition, it means that the domain name list has a high degree of relevance, and the source station domain name mainly comes from the relevant subdomains of one or several companies. At this time, a CDN domain name feature library can be established based on the subdomains in the above domain name list; if the number of clusters in the clustering results is less than or equal to the third threshold, that is, the number of clusters in the clustering results does not meet the third threshold condition, it means that the distribution of the domain name list is discrete, and it is necessary to calculate the average entropy value of all subdomain character strings in the domain name list for subsequent analysis. Among them, entropy is a standard for measuring the degree of information confusion. The higher the entropy value, the more random the characters. Based on this, the mean entropy value of the subdomain name string can be calculated to judge its randomness.

[0128] In the embodiment of the present disclosure, the entropy value of each subdomain string in the domain name list can be calculated by the second formula, where the second formula is:

[0129]

[0130] Where m is the number of all possible values ​​of the random variable X, P(x i ) is the random variable X taking value x i probability.

[0131] And, in the embodiment of the present disclosure, after obtaining the string entropy value of each subdomain name through the above steps, the average value of all string entropy values ​​under a certain level of domain name can be measured based on the string entropy value of each subdomain name, wherein the larger the average value, the more random the subdomain name string is, and the greater the probability that the subdomain name is used as a CDN scheduling entry. Based on this, if the average value of the string entropy values ​​of all subdomain names is greater than the fourth threshold, that is, the average value meets the fourth threshold condition, then a CDN domain name feature library can be established based on the subdomain name; if the average value of the string entropy value of the subdomain name is less than or equal to the fourth threshold, that is, the average value does not meet the fourth threshold condition, then a CDN domain name feature library is established based on the pattern and keywords of the subdomain name string. Among them, in the embodiment of the present disclosure, the above-mentioned method for establishing a CDN domain name feature library based on subdomain names can include: adding the subdomain names in the domain name list to the CDN domain name feature library.

[0132] Furthermore, in an embodiment of the present disclosure, the method for establishing a CDN domain name feature library based on a subdomain name string pattern may include: determining a target character pattern to which the subdomain name string belongs based on a preset character pattern, and establishing a CDN domain name feature library based on the target character pattern.

[0133] Among them, in the embodiment of the present disclosure, the above-mentioned preset character mode includes but is not limited to the following character modes:

[0134] Mode 1: User ID mode: UUID (Universally Unique Identifier) ​​is a standard format for identifying information. The standard format of UUID is 32 hexadecimal digits, divided into five parts, separated by hyphens, and the pattern is 8-4-4-4-12;

[0135] Mode 2: Language and region mode: Language and region usually consists of a language code and a region code (or country code). The above codes follow international standards (such as ISO 639 and ISO 3166) and are expressed in a specific format. For example, the language code and region code are separated by a hyphen - or an underscore _, and the format is language-region or language_region. For example, Chinese (China) is expressed as: zh-CN or zh_CN;

[0136] Mode 3: Format for representing dates: Define the components of a date (such as year, month, and day) through specific symbols and character combinations. The date mode can be adjusted according to different application scenarios and regional habits. For example, common date modes include 20xx-0x-0x or 0x-0x-20xx.

[0137] Furthermore, in an embodiment of the present disclosure, the above-mentioned method for establishing a CDN domain name feature library based on keywords may include: detecting keywords of subdomains, building a common keyword library of CDN domain name subdomains, traversing and matching through keywords, and building a CDN domain name feature library for subdomains that hit the keywords.

[0138] Furthermore, in the embodiment of the present disclosure, after the CDN domain name feature library is established through the above steps, the CDN domain name feature library can be continuously updated to provide strong data support for the subsequent judgment of whether the domain name hides the source station IP through the CDN.

[0139] Step 103: Based on the CDN domain name feature library, a domain name resolution linked list is established.

[0140] In the disclosed embodiment, after the CDN domain name feature library is obtained through the above steps, a domain name resolution linked list can be established based on the CDN domain name feature library.

[0141] Specifically, in the embodiment of the present disclosure, the method for establishing a domain name resolution time linked list based on the CDN domain name feature library may include: traversing the DNSRecord table, and establishing a time-series bidirectional linked list based on the time of domain name field resolution in the DNSRecord table, wherein each node in the time-series bidirectional linked list includes a CNAME list field and an IP list field. In the embodiment of the present disclosure, the CNAME list field and the IP list field may be empty.

[0142] For example, Figure 4 Schematic diagram of a time-series bidirectional linked list proposed in an embodiment of the present disclosure. Figure 4 As shown, the time-series bidirectional linked list corresponding to domain name A includes node 1, node 2, node 3 and node 4. Node 1 includes CNAME list 1, IP list 1 and resolution time 1, node 2 includes CNAME list 2, IP list 2 and resolution time 2, node 3 includes CNAME list 3, IP list 3 and resolution time 3, and node 4 includes CNAME list 4, IP list 4 and resolution time 4.

[0143] And, in the embodiment of the present disclosure, a hash table can be used to map the domain name and its corresponding sequential linked list. In the embodiment of the present disclosure, when updating the sequential linked list, a hash function is first used to calculate the hash value of the domain name, the position of the corresponding sequential linked list is determined, and the newly added domain name resolution record is inserted at the end of the linked list.

[0144] It should be noted that in the embodiment of the present disclosure, before establishing the domain name resolution chain list based on the CDN domain name feature library, the above method may also include: filtering the domain names in the CDN domain name feature library through a domain name whitelist to obtain the filtered domain names, and establishing the domain name resolution chain list based on the filtered domain names. The domain name whitelist can be constructed after confirmation based on the traffic, user volume, and total number of requests of the domain name.

[0145] Step 104: Determine the target IP address and candidate IP addresses of the target domain name based on the CDN domain name feature library and the domain name resolution chain table.

[0146] In the disclosed embodiment, after obtaining the CDN domain name feature library and the domain name resolution link list through the above steps, the target IP address and candidate IP addresses of the target domain name can be determined based on the CDN domain name feature library and the domain name resolution link list.

[0147] In one embodiment of the present disclosure, the method for determining the target IP address and candidate IP addresses of the target domain name based on the CDN domain name feature library and the domain name resolution chain table may include the following steps:

[0148] Step 1041: determine the hash value of the target domain name;

[0149] Step 1042: Determine a target domain name resolution linked list of the target domain name based on the hash value of the target domain name;

[0150] Step 1043: Determine whether the CNAME list field in the latest node of the linked list during target domain name resolution matches a feature in the CDN domain name feature library;

[0151] Step 1044: If the CNAME list field in the latest node hits the feature in the CDN domain name feature library, determine the target IP address of the target domain name based on the IP list field in the latest node;

[0152] Step 1045, traverse the target domain name resolution linked list to determine the candidate nodes and candidate IP addresses of the target domain name.

[0153] In the disclosed embodiment, after determining the target domain name resolution linked list based on the hash value of the target domain name, the CNAME domain name in the CNAME list field of the latest node (i.e., the node at the end of the linked list) in the target domain name resolution linked list can be traversed to determine whether the feature in the CDN domain name feature library is hit.

[0154] Among them, in the embodiment of the present disclosure, if the CNAME domain name in the CNAME list field hits the feature in the CDN domain name feature library, it means that an event has occurred in the target domain name that is accelerated by the source station pointing to the CDN domain name, and the source station backtracking is required. At this time, one of the IP addresses can be arbitrarily selected from the IP list field of the latest node to be determined as the target IP address of the target domain name; otherwise, there is no need to perform source station backtracking and analyze the remaining target domain names.

[0155] And, in the disclosed embodiment, after determining the target IP address, the linked list of the target domain name resolution can be traversed forward in time, and the node whose traversed CNAME list field is empty and whose IP list field is not empty is determined as the candidate node of the target domain name, and one of the IP addresses is arbitrarily selected from the IP list field of the candidate node to be determined as the candidate IP address of the candidate node. In the disclosed embodiment, if the linked list of the target domain name resolution is traversed and no qualified candidate node is found, the source station IP tracing of the target domain name fails, and the remaining target domain names are analyzed.

[0156] In the disclosed embodiment, based on the above-mentioned hash value and domain name time sequence linked list, rapid traceability can be performed in the memory, so that storage and search are efficient, real-time data is updated, historical data analysis is effective, efficient calculation, flexible scalability and multi-dimensional verification are achieved.

[0157] Step 105: Determine the page similarity between the target IP address and the candidate IP address, and determine the candidate IP address corresponding to the page similarity that meets the first threshold condition as the real IP address of the target domain name.

[0158] In the disclosed embodiment, after obtaining the target IP address and the candidate IP address through the above steps, the page similarity corresponding to the target IP address and the candidate IP address can be determined, and the candidate IP address corresponding to the page similarity that meets the first threshold condition can be determined as the real IP address of the target domain name.

[0159] In one embodiment of the present disclosure, the method for determining the page similarity corresponding to the target IP address and the candidate IP address, and determining the candidate IP address corresponding to the page similarity that meets the first threshold condition as the real IP address of the target domain name may include the following steps:

[0160] Step 1051, extracting a first page DOM (Document Object Model) frame of a target IP address and a second page DOM frame of a candidate IP address;

[0161] Step 1052: Determine the page similarity between the first page DOM frame and the second page DOM frame based on the tree edit distance;

[0162] Step 1053: If the page similarity satisfies the first threshold condition, the candidate IP address corresponding to the page similarity is determined as the real IP address of the target domain name;

[0163] Step 1054: If the page similarity does not meet the first threshold condition, the candidate IP address of the target domain name will be re-determined, and the above steps will be repeated until the real IP address of the target domain name or the target domain name corresponding to the target domain name is determined and the linked list traversal is completed.

[0164] In the disclosed embodiment, when a website introduces a CDN service for acceleration, it can select an acceleration mode, including static file acceleration or full-site acceleration mode. Among them, for content that the CDN service node cannot hit, the CDN service node will go back to the source station to obtain the content according to the configuration, and return the obtained content to the user side. Based on this, there is a time difference in simulating access to the target IP address and the candidate IP address, and the page content returned by the two may be different, and direct comparison of the content will result in missed judgments. Thus, the first page DOM frame of the target IP address and the second page DOM frame of the candidate IP address can be extracted, and page similarity analysis can be performed through the first page DOM frame and the second page DOM frame to improve the accuracy of source station identification.

[0165] Among them, in the embodiment of the present disclosure, the method for extracting the DOM frame of the first page of the target IP address may include: retaining the structure and static content in the first page, and removing the dynamic content in the first page. Among them, the dynamic content in the first page may include JavaScript code (including inline scripts and external script references), dynamically generated content (content dynamically generated by JavaScript), dynamic data (such as data loaded by Ajax requests), advertising and tracking codes (including advertising scripts and tracking scripts) and dynamic styles (such as styles loaded by JavaScript or dynamic CSS). In the embodiment of the present disclosure, the method for extracting the DOM frame of the second page of the candidate IP address is the same as the above method, and the embodiment of the present disclosure will not be repeated here.

[0166] And, in the embodiment of the present disclosure, the tree edit distance is a method for calculating the minimum number of edit operations between two trees. Among them, the edit operations include inserting, deleting and replacing nodes. And, the structure of the HTML page can be represented as a tree structure, based on which, the tree edit distance can be used to calculate the similarity of two HTML DOM trees. Among them, the method for determining the page similarity of the first page DOM frame and the second page DOM frame based on the tree edit distance is the same as the prior art, and the embodiment of the present disclosure will not be repeated here.

[0167] Furthermore, in the embodiment of the present disclosure, after determining the page similarity by the above method, the page similarity can be normalized so that the range of the page similarity is between (0, 1), and the page similarity after normalization is determined as the page similarity of the first page DOM frame and the second page DOM frame.

[0168] Furthermore, in the embodiment of the present disclosure, if the page similarity is greater than a first threshold, that is, the page similarity satisfies the first threshold condition, and the page content after CDN acceleration is consistent with the content of the source site, the candidate IP address corresponding to the page similarity is determined as the real IP address of the target domain name; if the page similarity is less than or equal to the first threshold, that is, the page similarity does not satisfy the first threshold condition, the candidate IP address of the target domain name will be re-determined, and the above steps will be repeated until the real IP address of the target domain name or the target domain name corresponding to the target domain name is determined and the linked list traversal is completed when the target domain name resolution is completed.

[0169] Furthermore, in the embodiment of the present disclosure, after determining the real IP address of the target domain name through the above steps, the above method may also include: adding the target domain name and the IP list field in the candidate node of the target domain name to the domain name traceability information library, and determining the real IP address of the CDN source station based on the domain name traceability information library.

[0170] Among them, in the embodiment of the present disclosure, after the domain name traceability information database is established through the above steps, the real source station can be found through the domain name traceability information database, so that the actual server location can be tracked and located, thereby providing clues for law enforcement agencies, and the network service provider can also be requested to disconnect the network connection of the source station and cut off the network operation of the website.

[0171] It should be noted that in the embodiments of the present disclosure, the above method can be applicable to different CDN service providers and various domain name structures, has good compatibility and scalability, and can be expanded and adjusted according to actual needs, and can flexibly respond to various complex network environments and attack methods.

[0172] The present disclosure proposes an IP address identification method for a CDN source station, which includes collecting user Internet logs and establishing a DNS record database based on the Internet logs; establishing a CDN domain name feature library based on the DNS record database; establishing a domain name resolution link list based on the CDN domain name feature library; determining a target IP address and a candidate IP address of a target domain name based on the CDN domain name feature library and the domain name resolution link list; determining the page similarity corresponding to the target IP address and the candidate IP address, and determining the candidate IP address corresponding to the page similarity that meets the first threshold condition as the real IP address of the target domain name. Therefore, the present disclosure can determine the real IP address of the target domain name through the CDN domain name feature library, the target IP address, and the page similarity corresponding to the candidate IP address, without making assumptions about the domain name features, thereby improving the accuracy of the CDN domain name, and without deploying a server, thereby reducing costs.

[0173] Figure 5 According to some embodiments of the present disclosure, a CDN source station IP address identification device is shown. Figure 5 As shown, the device may include:

[0174] The first establishment module 501 is used to collect user online logs and establish a DNS record database based on the online logs;

[0175] The second establishing module 502 is used to establish a CDN domain name feature library based on the DNS record database;

[0176] The third establishing module 503 is used to establish a domain name resolution link table based on the CDN domain name feature library;

[0177] A first determination module 504 is used to determine a target IP address and candidate IP addresses of a target domain name based on a CDN domain name feature library and a domain name resolution chain table;

[0178] The second determination module 505 is used to determine the page similarity corresponding to the target IP address and the candidate IP address, and determine the candidate IP address corresponding to the page similarity that meets the first threshold condition as the real IP address of the target domain name.

[0179] In the embodiment of the present disclosure, the first establishing module 501 is specifically used to:

[0180] Collect users' Internet logs through probe devices;

[0181] Parse the DNS protocol in Internet logs and extract key information;

[0182] Based on the key information, a DNS record database is established.

[0183] Optionally, in the embodiment of the present disclosure, the CDN domain name feature library includes a DNSRecord data table; the second establishing module 502 is specifically used to:

[0184] Traverse the CNAME list field in the DNSRecord table and build the corresponding domain name multi-branch tree;

[0185] Determine the target subdomain and the parent domain of the target subdomain in the domain name multi-branch tree;

[0186] Traverse the DNSRecord table to obtain the domain name list in the CNAME list that jumps to the parent domain name;

[0187] Based on the domain name list, establish a CDN domain name feature library.

[0188] Optionally, in the embodiment of the present disclosure, the second establishing module 502 is further used to:

[0189] Determining whether the length of the domain name list meets a second threshold condition;

[0190] If the length of the domain name list meets the second threshold condition, clustering the domain names in the domain name list to obtain a clustering result;

[0191] If the number of clusters in the clustering result does not meet the third threshold condition, then the average entropy value of all subdomain strings in the domain name list is calculated;

[0192] If the average value meets the fourth threshold condition, a CDN domain name feature library is established based on the subdomain name;

[0193] If the average value does not meet the fourth threshold condition, a CDN domain name feature library is established based on the pattern and keywords of the subdomain name string.

[0194] Optionally, in the embodiment of the present disclosure, the second establishing module 502 is further used to:

[0195] Traverse the domain name list and build a domain name list matrix;

[0196] The domain name list matrix is ​​used as the input of DBSCAN, and clustering is performed through DBSCAN to obtain the clustering results.

[0197] Optionally, in the embodiment of the present disclosure, the CDN domain name feature library includes a DNSRecord data table; the third establishment module 503 is specifically used to:

[0198] The DNSRecord table is traversed, and a time-series bidirectional linked list is established based on the time of domain name field resolution in the DNSRecord table, wherein each node in the time-series bidirectional linked list includes a CNAME list field and an IP list field.

[0199] Optionally, in the embodiment of the present disclosure, the first determining module 504 is specifically configured to:

[0200] Determine the hash value of the target domain name;

[0201] Based on the hash value of the target domain name, determine the target domain name resolution linked list of the target domain name;

[0202] Determine whether the CNAME list field in the latest node of the linked list during target domain name resolution matches the feature in the CDN domain name feature library;

[0203] If the CNAME list field in the latest node matches the feature in the CDN domain name feature library, the target IP address of the target domain name is determined based on the IP list field in the latest node;

[0204] Traverse the linked list when resolving the target domain name to determine the candidate nodes and candidate IP addresses of the target domain name.

[0205] Optionally, in the embodiment of the present disclosure, the second determining module 505 is specifically configured to:

[0206] Extracting a first page DOM frame of the target IP address and a second page DOM frame of the candidate IP address;

[0207] Determine page similarity between the first page DOM frame and the second page DOM frame based on the tree edit distance;

[0208] If the page similarity meets the first threshold condition, the candidate IP address corresponding to the page similarity is determined as the real IP address of the target domain name;

[0209] If the page similarity does not meet the first threshold condition, the candidate IP address of the target domain name will be re-determined, and the above steps will be repeated until the real IP address of the target domain name or the target domain name corresponding to the target domain name is determined and the linked list traversal is completed.

[0210] Optionally, in the embodiment of the present disclosure, the above device is also used for:

[0211] Add the target domain name and the IP list field in the candidate node of the target domain name to the domain name tracing information base;

[0212] Based on the domain name tracing information database, determine the real IP address of the CDN source station.

[0213] Optionally, in the embodiment of the present disclosure, the above device is also used for:

[0214] The domain names in the CDN domain name feature library are filtered through a domain name whitelist to obtain filtered domain names;

[0215] Based on the filtered domain names, a domain name resolution linked list is established.

[0216] like Figure 6 As shown, the electronic device 600 includes a computing unit 601, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 602 or a computer program loaded from a storage unit 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the electronic device 600 can also be stored. The computing unit 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0217] Multiple components in the electronic device 600 are connected to the I / O interface 605, including: an input unit 606, such as a keyboard, a mouse, etc.; an output unit 607, such as various types of displays, speakers, etc.; a storage unit 608, such as a disk, an optical disk, etc.; and a communication unit 609, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 609 allows the electronic device 600 to exchange information / data with other electronic devices through a computer network such as the Internet and / or various telecommunication networks.

[0218] The computing unit 601 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 601 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 601 performs the various methods and processes described above, such as the IP address identification method of the CDN source station. For example, in some embodiments, the IP address identification method of the CDN source station may be implemented as a computer software program, which is tangibly included in a machine-readable medium, such as a storage unit 608. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 600 via the ROM 602 and / or the communication unit 609. When the computer program is loaded into the RAM 603 and executed by the computing unit 601, one or more steps of the IP address identification method of the CDN source station described above may be performed. Alternatively, in other embodiments, the computing unit 601 may be configured to execute the method for identifying the IP address of the CDN source station in any other appropriate manner (eg, by means of firmware).

[0219] Various embodiments of the devices and techniques described above herein can be implemented in digital electronic circuit devices, integrated circuit devices, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), devices on a chip (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable device including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage device, at least one input device, and at least one output device, and transmit data and instructions to the storage device, the at least one input device, and the at least one output device.

[0220] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0221] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution device, device, or electronic device. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor devices, devices, or electronic devices, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage electronic device, a magnetic storage electronic device, or any suitable combination of the foregoing.

[0222] To provide interaction with a user, the devices and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0223] The apparatus and techniques described herein may be implemented in a computing device including backend components (e.g., as a data server), or a computing device including middleware components (e.g., an application server), or a computing device including frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the apparatus and techniques described herein), or a computing device including any combination of such backend components, middleware components, or frontend components. The components of the apparatus may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), the Internet, and a blockchain network.

[0224] A computer device may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship between the client and the server is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or a cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services ("Virtual Private Server", or "VPS" for short). The server may also be a server of a distributed device, or a server combined with a blockchain.

[0225] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0226] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A method for identifying an IP address of a CDN source station, characterized in that: The method comprises: Collecting user online logs and establishing a domain name system DNS record database based on the online logs; Based on the DNS record database, a CDN domain name feature database is established; Based on the CDN domain name feature library, a domain name resolution link table is established; Determine the target network protocol IP address and candidate IP addresses of the target domain name based on the CDN domain name feature library and the domain name resolution chain table; The page similarity corresponding to the target IP address and the candidate IP address is determined, and the candidate IP address corresponding to the page similarity that meets the first threshold condition is determined as the real IP address of the target domain name.

2. The method according to claim 1, characterized in that The collecting of user surfing logs and establishing a DNS record database based on the surfing logs includes: Collecting the user's online logs through a probe device; Parsing the DNS protocol in the Internet access log and extracting key information; Based on the key information, a DNS record database is established.

3. The method according to claim 1, characterized in that The CDN domain name feature database includes a DNSRecord data table; the CDN domain name feature database is established based on the DNS record database, including: Traverse the canonical name CNAME list field in the DNSRecord table to build a corresponding domain name multi-branch tree; Determine a target subdomain name and a parent domain name of the target subdomain name in the domain name multi-branch tree; Traverse the DNSRecord table to obtain a list of domain names in the CNAME list that jump to the parent domain name; Based on the domain name list, a CDN domain name feature library is established.

4. The method according to claim 3, characterized in that The step of establishing a CDN domain name feature library based on the domain name list includes: Determining whether the length of the domain name list meets a second threshold condition; If the length of the domain name list meets the second threshold condition, clustering the domain names in the domain name list to obtain a clustering result; If the number of clusters in the clustering result does not meet the third threshold condition, then calculating the average entropy value of all subdomain character strings in the domain name list; If the average value satisfies a fourth threshold condition, establishing a CDN domain name feature library based on the subdomain name; If the average value does not meet the fourth threshold condition, a CDN domain name feature library is established based on the pattern and keywords of the subdomain name character string.

5. The method according to claim 4, characterized in that The clustering of the domain names in the domain name list to obtain a clustering result includes: Traverse the domain name list and construct a domain name list matrix; The domain name list matrix is ​​used as the input of the density-based spatial clustering method DBSCAN with noise, and clustering is performed through DBSCAN to obtain a clustering result.

6. The method according to claim 1, characterized in that The CDN domain name feature library includes a DNSRecord data table; the domain name resolution link table is established based on the CDN domain name feature library, including: The DNSRecord table is traversed, and a time-series bidirectional linked list is established based on the time of resolution of the domain name field in the DNSRecord table, wherein each node in the time-series bidirectional linked list includes a CNAME list field and an IP list field.

7. The method according to claim 1, characterized in that The determining the target IP address and candidate IP addresses of the target domain name based on the CDN domain name feature library and the domain name resolution chain table includes: Determine the hash value of the target domain name; Determine a target domain name resolution linked list of the target domain name based on the hash value of the target domain name; Determine whether the CNAME list field in the latest node of the linked list during the resolution of the target domain name hits the feature in the CDN domain name feature library; If the CNAME list field in the latest node hits the feature in the CDN domain name feature library, determining the target IP address of the target domain name based on the IP list field in the latest node; The target domain name resolution linked list is traversed to determine the candidate nodes and the candidate IP addresses of the target domain name.

8. The method according to claim 1, characterized in that The determining of the page similarity corresponding to the target IP address and the candidate IP address, and determining the candidate IP address corresponding to the page similarity that meets the first threshold condition as the real IP address of the target domain name includes: Extracting a first page document object model DOM frame of the target IP address and a second page DOM frame of the candidate IP address; Determine page similarity between the first page DOM framework and the second page DOM framework based on the tree edit distance; If the page similarity satisfies a first threshold condition, determining the candidate IP address corresponding to the page similarity as the real IP address of the target domain name; If the page similarity does not meet the first threshold condition, the candidate IP address of the target domain name will be re-determined, and the above steps will be repeated until the real IP address of the target domain name is determined or the linked list traversal is completed when the target domain name corresponding to the target domain name is resolved.

9. The method according to claim 1, characterized in that The method further comprises: Add the target domain name and the IP list field in the candidate node of the target domain name to the domain name tracing information base; Based on the domain name tracing information database, the real IP address of the CDN source station is determined.

10. The method according to claim 1, characterized in that Before establishing a domain name resolution linked list based on the CDN domain name feature library, the method further includes: Filter the domain names in the CDN domain name feature library through a domain name whitelist to obtain filtered domain names; Based on the filtered domain names, a domain name resolution linked list is established.

11. A CDN source station IP address identification device, characterized in that: The device comprises: A first establishment module is used to collect user online logs and establish a DNS record database based on the online logs; A second establishing module is used to establish a CDN domain name feature library based on the DNS record database; A third establishment module is used to establish a domain name resolution link list based on the CDN domain name feature library; A first determination module, configured to determine a target IP address and candidate IP addresses of a target domain name based on the CDN domain name feature library and the domain name resolution chain table; The second determination module is used to determine the page similarity corresponding to the target IP address and the candidate IP address, and determine the candidate IP address corresponding to the page similarity that meets the first threshold condition as the real IP address of the target domain name.

12. A non-transitory computer-readable storage medium, wherein the computer storage medium stores computer-executable instructions; after the computer-executable instructions are executed by a processor, the method according to any one of claims 1 to 10 can be implemented.

13. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 10 is implemented.

Images