Method, device and storage medium for identifying IP address of CDN source station

Abstract

The present disclosure provides an IP address identification method and device of a CDN source station and a storage medium, comprising: collecting user online logs, and establishing a DNS record database based on the online logs; establishing a CDN domain name feature library based on the DNS record database; establishing a domain name resolution time chain table based on the CDN domain name feature library; determining a target IP address and a candidate IP address of a target domain name based on the CDN domain name feature library and the domain name resolution time chain table; determining the page similarity corresponding to the target IP address and the candidate IP address, and determining the candidate IP address corresponding to the page similarity meeting the first threshold condition as the real IP address of the target domain name. Thus, the present disclosure determines the real IP address of the target domain name through the CDN domain name feature library, the page similarity corresponding to the target IP address and the candidate IP address, without assuming domain name features, improving the accuracy of the CDN domain name, and without deploying servers, reducing the cost.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of information security, and particularly relates to a CDN source station IP address identification method and device and storage medium. BACKGROUND

[0002] With the explosive growth of Internet users, more and more Internet service providers use CDN (Content Delivery Network) services to achieve social and economic benefits. However, while CDN services are widely used, there are also cases of using CDN (Content Delivery Network) technology to hide the real IP of the source station, making it impossible to effectively regulate illegal and irregular websites on the CDN. Based on this, it is necessary to identify the IP address of the CDN source station to provide strong support for subsequent tracking and positioning of websites.

[0003] In the prior art, various CDN identification attributes can be used, and a CDN classifier formed by the Naive Bayes principle can be used for analysis, and a site without a certain feature will not be misjudged. However, the Naive Bayes classifier assumes that all features are independent, but in the actual network environment, there may be correlations between various CDN identification attributes. Based on this, the inconsistency of the above assumption may cause deviation of the classification result, reducing the accuracy of detection. Alternatively, the source station is mined based on Ping technology, but this method depends on the geographical coverage and configuration of the CDN. If the CDN vendor also deploys nodes abroad, the Ping test may resolve the IP of the CDN node instead of the real source station IP, so that the real source station cannot be identified, and in order to effectively perform the Ping test, servers need to be deployed in multiple geographic locations, increasing the complexity and cost of deployment and maintenance. SUMMARY

[0004] To overcome the problems in the related art, the present disclosure provides a CDN source station IP address identification method, device and storage medium.

[0005] According to a first aspect of an embodiment of the present disclosure, a CDN source station IP address identification method is provided, the method comprising:

[0006] Collecting user Internet logs, and establishing a DNS record database based on the Internet logs;

[0007] Based on the DNS record database, a CDN domain name feature library is established;

[0008] Based on the CDN domain name feature library, a domain name resolution time chain table is established;

[0009] determine a target IP address and a candidate IP address of the target domain name based on the CDN domain name feature library and the domain name resolution chain table;

[0010] determine a page similarity corresponding to the target IP address and the candidate IP address, and determine a candidate IP address corresponding to a page similarity satisfying a first threshold condition as a real IP address of the target domain name.

[0011] Optionally, in the embodiments of the present disclosure, the user Internet log is collected, and a DNS record database is established based on the Internet log, including:

[0012] the Internet log of the user is collected through a probe device;

[0013] the DNS protocol in the Internet log is parsed, and key information is extracted;

[0014] the DNS record database is established based on the key information.

[0015] Optionally, in the embodiments of the present disclosure, the CDN domain name feature library includes a DNSRecord data table; and the CDN domain name feature library is established based on the DNS record database, including:

[0016] traverse a CNAME list field in the DNSRecord table to construct a corresponding domain name multi-ary tree;

[0017] determine a target subdomain name in the domain name multi-ary tree and a parent domain name of the target subdomain name;

[0018] traverse the DNSRecord table to obtain a domain name list in the CNAME list that jumps to the parent domain name;

[0019] the CDN domain name feature library is established based on the domain name list.

[0020] Optionally, in the embodiments of the present disclosure, the CDN domain name feature library is established based on the domain name list, including:

[0021] determine whether a length of the domain name list satisfies a second threshold condition;

[0022] if the length of the domain name list satisfies the second threshold condition, cluster the domain names in the domain name list to obtain a clustering result;

[0023] if a cluster number in the clustering result does not satisfy a third threshold condition, calculate an average value of entropy values of all subdomain name strings in the domain name list;

[0024] if the average value satisfies a fourth threshold condition, establish the CDN domain name feature library based on the subdomain names.

[0025] If the average value does not satisfy the fourth threshold condition, a CDN domain name feature library is established based on a pattern and a keyword of the subdomain name string.

[0026] Optionally, in the embodiments of the present disclosure, the clustering of the domain names in the domain name list comprises:

[0027] The domain name list is traversed to construct a domain name list matrix.

[0028] The domain name list matrix is taken as an input of DBSCAN, and clustering is performed by DBSCAN to obtain a clustering result.

[0029] Optionally, in the embodiments of the present disclosure, the CDN domain name feature library comprises a DNSRecord data table; and the establishment of a domain name resolution time chain table based on the CDN domain name feature library comprises:

[0030] The DNSRecord table is traversed, and a time sequence bidirectional chain table is established based on a time of domain name field resolution in the DNSRecord table, wherein each node in the time sequence bidirectional chain table comprises a CNAME list field and an IP list field.

[0031] Optionally, in the embodiments of the present disclosure, the determination of a target IP address and a candidate IP address of a target domain name based on the CDN domain name feature library and the domain name resolution time chain table comprises:

[0032] A hash value of the target domain name is determined.

[0033] A target domain name resolution time chain table of the target domain name is determined based on the hash value of the target domain name.

[0034] It is determined whether a CNAME list field in a latest node of the target domain name resolution time chain table hits a feature in the CDN domain name feature library.

[0035] If the CNAME list field in the latest node hits the feature in the CDN domain name feature library, a target IP address of the target domain name is determined based on an IP list field in the latest node.

[0036] The target domain name resolution time chain table is traversed to determine a candidate node of the target domain name and the candidate IP address.

[0037] Optionally, in the embodiments of the present disclosure, the determination of a page similarity corresponding to the target IP address and the candidate IP address, and the determination of a candidate IP address corresponding to a page similarity satisfying a first threshold condition as a real IP address of the target domain name, comprises:

[0038] extract a first page DOM framework of the target IP address and a second page DOM framework of the candidate IP address;

[0039] determine a page similarity of the first page DOM framework and the second page DOM framework based on a tree edit distance;

[0040] if the page similarity satisfies a first threshold condition, determine the candidate IP address corresponding to the page similarity as a real IP address of the target domain name;

[0041] if the page similarity does not satisfy the first threshold condition, repeatedly determine a candidate IP address of the target domain name, and repeat the above steps until a real IP address of the target domain name is determined or a chain table for domain name resolution is traversed completely.

[0042] Optionally, in the embodiments of the present disclosure, the method further comprises:

[0043] adding the target domain name and an IP list field in the candidate node of the target domain name into a domain name tracing information library;

[0044] determining a real IP address of a CDN source station based on the domain name tracing information library.

[0045] Optionally, in the embodiments of the present disclosure, before the CDN domain name feature library is used to establish a chain table for domain name resolution, the method further comprises:

[0046] filtering domain names in the CDN domain name feature library to obtain filtered domain names;

[0047] establishing a chain table for domain name resolution based on the filtered domain names.

[0048] According to a second aspect of the embodiments of the present disclosure, a CDN source station IP address identification device is provided, characterized in that the device comprises:

[0049] a first establishment module configured to collect user online logs and establish a DNS record database based on the online logs;

[0050] a second establishment module configured to establish a CDN domain name feature library based on the DNS record database;

[0051] a third establishment module configured to establish a chain table for domain name resolution based on the CDN domain name feature library;

[0052] a first determination module configured to determine a target IP address and a candidate IP address of a target domain name based on the CDN domain name feature library and the chain table for domain name resolution;

[0053] A second determining module is configured to determine a page similarity corresponding to the target IP address and the candidate IP address, and determine the candidate IP address corresponding to the page similarity meeting a first threshold condition as the real IP address of the target domain name.

[0054] According to a third aspect of embodiments of the present disclosure, an electronic device is provided, comprising:

[0055] a processor;

[0056] a memory for storing processor-executable instructions;

[0057] The processor is configured to implement the method in the first aspect.

[0058] According to a fourth aspect of embodiments of the present disclosure, a non-transitory computer-readable storage medium is provided, which stores computer-executable instructions; the computer-executable instructions are executed by a processor to implement the method in the first aspect.

[0059] The technical solutions provided by the embodiments of the present disclosure can have the following beneficial effects:

[0060] The method, device and storage medium for identifying IP address of CDN source station provided by the present disclosure include the following steps: collecting user online log, and establishing DNS record database based on the online log; establishing CDN domain name feature library based on the DNS record database; establishing domain name resolution time chain table based on the CDN domain name feature library; determining target IP address and candidate IP address of target domain name based on the CDN domain name feature library and the domain name resolution time chain table; determining page similarity corresponding to the target IP address and the candidate IP address, and determining the candidate IP address corresponding to the page similarity meeting a first threshold condition as the real IP address of the target domain name. Thus, the present disclosure can determine the real IP address of the target domain name through the CDN domain name feature library, the page similarity corresponding to the target IP address and the candidate IP address, without making assumptions about the domain name features, improving the accuracy of the CDN domain name, and without deploying servers, reducing costs.

[0061] It should be understood that the foregoing general description and the following detailed description are only exemplary and explanatory, and cannot limit the present disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0062] The accompanying drawings, which are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure and, together with the specification, serve to explain the principles of the present disclosure.

[0063] Figure 1 is a flowchart of a method for identifying IP address of CDN source station according to some embodiments of the present disclosure;

[0064] Figure 2 is a schematic diagram of DNS resolution according to some embodiments of the present disclosure;

[0065] Figure 3 is a schematic diagram of a domain name multi-ary tree according to some embodiments of the present disclosure;

[0066] Figure 4 is a schematic diagram of a time-ordered doubly linked list according to some embodiments of the present disclosure;

[0067] Figure 5 is a schematic diagram of a structure of an IP address identification apparatus of a CDN source station according to some embodiments of the present disclosure;

[0068] Figure 6 is a block diagram of an electronic device suitable for performing an IP address identification method of a CDN source station according to some embodiments of the present disclosure. DETAILED DESCRIPTION

[0069] The present disclosure will now be described in detail with specific reference to a number of embodiments in the accompanying drawings. The following description is made with reference to the accompanying drawings in which the same or like reference numerals in different drawings represent the same or similar elements. Variations, modifications, and equivalents of the methods, devices, and / or systems described herein will become apparent to those having ordinary skill in the art upon reading the foregoing description. For instance, the order in which operations are described is merely exemplary and the operations need not be performed in the order described unless otherwise specified. Additionally, some of the features described herein can be used to configure, enable, or enhance the performance of other devices. Furthermore, the description of features in the following description need not be limited to only those features necessary to configure, enable, or enhance the performance of the devices described herein. The features described herein can be used in a variety of applications.

[0070] The implementations described below in some embodiments of the present disclosure are not meant to represent all implementations consistent with the present disclosure. Rather, they are examples of apparatuses and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0071] Now in the art, according to the DNS history database in the historical database list, it can be determined whether there is an IP address corresponding to the domain name in each DNS history database, and when there is an IP address corresponding to the domain name, the IP address is determined as the IP address of the CDN source station. Wherein, this method is simple and direct, easy to implement. But this method mainly depends on the record in the historical DNS database to identify the source station IP, although it is simple and direct, but it lacks the fine-grained analysis of data, and the DNS resolution records of different time periods and different geographical positions may be different, if not analyzed in detail, some key details may be ignored. And this method does not further verify the IP address obtained from the historical DNS record, and directly determines it as the source station IP, which may lead to inaccurate identification results.

[0072] Figure 1 is a flow diagram of a CDN source station IP address identification method according to some embodiments of the present disclosure, as shown in Figure 1 The method can include the following steps:

[0073] Step 101, collect user Internet logs, and establish a DNS record database based on the Internet logs.

[0074] It should be noted that the CDN source station IP address identification method described above is executed by a CDN source station IP address identification device, which can be implemented by software and / or hardware. The CDN source station IP address identification device in this embodiment can be configured in an electronic device.

[0075] In this example embodiment, the electronic device can include terminal equipment and server equipment, and the embodiment does not limit the electronic device.

[0076] In the present disclosure, the method of collecting user Internet logs and establishing a DNS (Domain Name System) record database based on the Internet logs can include the following steps:

[0077] Step one, collect user Internet logs through a probe device;

[0078] Step two, parse the DNS protocol in the Internet log and extract key information;

[0079] Step three, based on the key information, establish a DNS record database.

[0080] In this embodiment of the present disclosure, the probe device can be deployed on the network interface (such as S1-U of 4G and N9 of 5G) to collect user Internet logs (such as HTTP requests and DNS queries).

[0081] In the embodiments of the present disclosure, after collecting the user's online log through the above steps, the DNS protocol in the online log can be parsed, the key information of the DNS response can be extracted, and the DNS XDR data can be established based on the key information, wherein the key information can include:

[0082] 1) Transaction ID: unique identification of the DNS session

[0083] 2) Query Name: domain name queried

[0084] 3) Query Type: query type

[0085] 4) Response Code: DNS response code, indicating query success or error type

[0086] 5) Answer: IP address or other data obtained by parsing

[0087] 6) TTL: record lifetime

[0088] 7) Timestamp: query and response timestamp

[0089] 8) Client IP: user device IP address initiating the DNS query

[0090] 9) Server IP: server IP address processing the DNS query

[0091] In the embodiments of the present disclosure, after obtaining the key information through the above steps, the DNS record database can be established based on the key information according to a preset rule. The CDN domain name feature library can include a DNSRecord data table, and the key fields of the DNSRecord data table can include: Query Name: domain name queried; Answer: IP address or other data obtained by parsing; CNAME list: redirect domain name list (may exist multiple jumps); IP list: A / AAAA record parsing IP address list (may exist multiple).

[0092] In the embodiments of the present disclosure, during the online process, there can be a large number of repeated DNS query records for the same domain name. When scanning the DNS XDR data based on the key information and establishing the DNS record database, a preset rule is needed to remove the DNS XDR data, select the changed data for storage, and record the key information to save storage space.

[0093] Specifically, in the embodiments of the present disclosure, the above preset rule can include:

[0094] Rule 1, search if there is a record with the Query Name of the domain name in the search table, if not, insert a new record;

[0095] Rule 2, if there is a record, judge if there is a CNAME record in the Answer content in the XDR, if there is a CNAME record, compare the CNAME content in the Answer with the CNAME of the existing record, if consistent, do not insert a new record, otherwise, insert a new record according to the Answer content of the XDR;

[0096] Rule 3, if there is a record, judge if there is a CNAME record in the Answer content in the XDR, if there is no CNAME record, compare the IP (Internet Protocol) address list in the Answer with the IP List of the existing record, if consistent, do not insert a new record, otherwise, insert a new record according to the Answer content of the XDR.

[0097] In addition, in the embodiment of the present disclosure, the DNSRecord table is continuously updated according to the above-mentioned preset rules to maintain a real-time DNS resolution record table as the data basis for the subsequent establishment of the domain name resolution time sequence chain and the CDN domain name feature library.

[0098] Step 102, based on the DNS record database, establish the CDN domain name feature library.

[0099] In the embodiment of the present disclosure, after the user purchases the acceleration service provided by a CDN service provider, the CDN service provider will provide a CNAME domain name for the website, which usually points to the DNS scheduling server of the CDN service provider. After receiving the CNAME domain name, the user needs to configure the DNS resolution on the domain name provider of the website, and point the CNAME record of the original domain name to the domain name. After the above configuration is completed and takes effect, when the user accesses the website, in the DNS resolution link, the DNS scheduling server will perform load balancing based on the geographical location of the user, and return the optimal node IP in the DNS response, so as to route the user request to the nearest CDN node, so as to achieve the acceleration target.

[0100] In the embodiment of the present disclosure, the CDN domain name feature library is established based on the DNS record database. Figure 2 A schematic diagram of DNS resolution provided by the embodiment of the present disclosure is shown in FIG. 1. Figure 2As shown, the CNAME domain name configured for the domain name zoscf.0qy2t0.cyou is df2eba67.guangcdn.com. After the user's DNS request enters the CDN scheduling entrance, multiple scheduling and jumping such as regional DNS scheduling can be performed, and finally the IP addresses (35.79.242.233 and 20.2.80.50) of two CDN nodes for load balancing are returned to the user. After receiving the DNS query result, the user selects one of the IP addresses to establish an HTTP request.

[0101] In the embodiments of the present disclosure, the CDN server uses a subdomain name with a random string as the CNAME domain name of the scheduling entrance, so that the subdomain name with the random string can disperse the user's request to multiple servers to achieve load balancing. The random string increases the difficulty of prediction, and it is difficult for attackers to lock specific CDN nodes for attack. At the same time, fault transfer and rapid response are achieved through flexible DNS configuration and scheduling strategy.

[0102] In addition, in the embodiments of the present disclosure, after the DNS record database is obtained through the above steps, a CDN domain name feature library can be established based on the DNS record database.

[0103] Specifically, in the embodiments of the present disclosure, the method for establishing a CDN domain name feature library based on the DNS record database can include the following steps:

[0104] Step 1021, traversing the CNAME (Canonical Name) list field in the DNSRecord table to construct a corresponding domain name multi-ary tree;

[0105] Step 1022, determining a target subdomain name in the domain name multi-ary tree and a parent domain name of the target subdomain name;

[0106] Step 1023, traversing the DNSRecord table to obtain a domain name list in the CNAME list that jumps to the parent domain name;

[0107] Step 1024, establishing a CDN domain name feature library based on the domain name list.

[0108] In the embodiments of the present disclosure, the CNAME list field in the DNSRecord table is traversed to split the CNAME domain name by the symbol "." to construct a domain name multi-ary tree. For example, Figure 3 A schematic diagram of a domain name multi-ary tree provided by the embodiments of the present disclosure.

[0109] Further, in the embodiments of the present disclosure, after the target subdomain name and the parent domain name of the target subdomain name are determined through the above steps, the DNSRecord table can be traversed to obtain a domain name list in the CNAME list that jumps to the parent domain name, and a CDN domain name feature library can be established based on the domain name list. For example, assuming that the parent domain name is guangcdn.com, the DNSRecord table is traversed to obtain a domain name list that jumps to the parent domain name that meets *.guangcdn.com through CNAME.

[0110] Further, in the embodiments of the present disclosure, after the target subdomain name and the parent domain name of the target subdomain name are determined through the above steps, the DNSRecord table can be traversed to obtain a domain name list in the CNAME list that jumps to the parent domain name, and a CDN domain name feature library can be established based on the domain name list. For example, assuming that the parent domain name is guangcdn.com, the DNSRecord table is traversed to obtain a domain name list that jumps to the parent domain name that meets *.guangcdn.com through CNAME.

[0111] Specifically, in the embodiments of the present disclosure, the method for establishing the CDN domain name feature library based on the domain name list can include the following steps:

[0112] Step 1, determining whether the length of the domain name list meets a second threshold condition;

[0113] Step 2, if the length of the domain name list meets the second threshold condition, clustering the domain names in the domain name list to obtain a clustering result;

[0114] Step 3, if the number of clusters in the clustering result does not meet a third threshold condition, calculating an average value of the entropy values of all subdomain name strings in the domain name list;

[0115] Step 4, if the average value meets a fourth threshold condition, establishing the CDN domain name feature library based on the subdomain name;

[0116] Step 5, if the average value does not meet the fourth threshold condition, establishing the CDN domain name feature library based on the pattern and the keyword of the subdomain name string.

[0117] In the embodiments of the present disclosure, the method for determining whether the length of the domain name list meets the second threshold condition can include determining whether the length of the domain name list is greater than a second threshold value, and if the length of the domain name list is greater than the second threshold value, determining that the length of the domain name list meets the second threshold condition; if the length of the domain name list is less than or equal to the second threshold value, determining that the length of the domain name list does not meet the second threshold condition. In the embodiments of the present disclosure, the second threshold value can be set as needed, for example, 4.

[0118] In the embodiments of the present disclosure, if the length of the domain name list does not satisfy the second threshold condition, a CDN domain name feature library can be established based on the pattern and the keyword of the subdomain name string. Details of this part will be introduced in subsequent embodiments.

[0119] In addition, in the embodiments of the present disclosure, if the length of the domain name list satisfies the second threshold condition, the domain names in the domain name list can be clustered to obtain a clustering result. Specifically, the method for clustering the domain names in the domain name list to obtain the clustering result in the embodiments of the present disclosure can include: traversing the domain name list, constructing a domain name list matrix, and taking the domain name list matrix as the input of DBSCAN (Density-Based Spatial Clustering of Applications with Noise), and clustering by DBSCAN to obtain the clustering result.

[0120] In the embodiments of the present disclosure, the method for traversing the domain name list and constructing the domain name list matrix can include: traversing the domain name list, calculating the Levenshtein similarity between domain names D i and D j , and filling the value of the similarity into the domain name list matrix to establish the domain name list matrix.

[0121] In the embodiments of the present disclosure, the Levenshtein similarity between domain names D i and D j can be calculated by a first formula, where the first formula is:

[0122]

[0123] wherein Levenshtein(D i , D j ) is the Levenshtein distance between domain names D i and D j , |D i | and |D j | are the character lengths of domain names D i and D j .

[0124] For example, assuming that the length of the domain name list is L, the Levenshtein similarity between domain names D i and D j is obtained by the above steps, and the obtained similarity is filled into the matrix M ij to obtain the corresponding domain name list matrix M.

[0125] Further, in the embodiments of the present disclosure, before determining whether the number of clusters in the clustering result satisfies the third threshold condition, the method can further include: calculating the silhouette coefficient of each point in the clustering result, and calculating the average silhouette coefficient of the clustering result, and adjusting the parameters in DBSCAN according to the result of the average silhouette coefficient, so that the clustering result can be optimized.

[0126] Further, in the embodiments of the present disclosure, before determining whether the number of clusters in the clustering result satisfies the third threshold condition, the method can further include: calculating the silhouette coefficient of each point in the clustering result, and calculating the average silhouette coefficient of the clustering result, and adjusting the parameters in DBSCAN according to the result of the average silhouette coefficient, so that the clustering result can be optimized.

[0127] In the embodiments of the present disclosure, the number of clusters in the clustering result obtained through the above steps reflects the number of different categories or groups in the domain name list. Based on this, the relevance of the domain name list can be determined based on the number of clusters in the clustering result. Specifically, in the embodiments of the present disclosure, if the number of clusters in the clustering result is greater than the third threshold, that is, the number of clusters in the clustering result satisfies the third threshold condition, it indicates that the domain name list has high relevance, and the source station domain name mainly comes from one or several company-related subdomain names. At this time, the CDN domain name feature library can be established based on the subdomain names in the above domain name list; if the number of clusters in the clustering result is less than or equal to the third threshold, that is, the number of clusters in the clustering result does not satisfy the third threshold condition, it indicates that the distribution of the domain name list is discrete, and the average value of the entropy values of all subdomain name strings in the domain name list needs to be calculated for subsequent analysis. Wherein, the entropy is a standard for measuring the degree of information disorder, and the higher the entropy value, the more random the characters are. Based on this, the average entropy value of the subdomain name string can be calculated to judge its randomness.

[0128] In the embodiments of the present disclosure, the entropy value of each subdomain name string in the domain name list can be calculated by a second formula, wherein the second formula is:

[0129]

[0130] Wherein, m is the number of all possible values of random variable X, P(x i ) is the probability of random variable X taking value x i .

[0131] Furthermore, in the embodiments of the present disclosure, after the string entropy value of each subdomain name is obtained through the above steps, the average value of all string entropy values under a certain level domain name can be measured based on the string entropy value of each subdomain name, wherein the greater the average value is, the more random the subdomain name string is, and the greater the probability of the subdomain name as a CDN scheduling entry is. Based on this, if the average value of all subdomain name string entropy values is greater than a fourth threshold value, that is, the average value satisfies the fourth threshold value condition, at this time, the CDN domain name feature library can be established based on the subdomain name; if the average value of the subdomain name string entropy value is less than or equal to the fourth threshold value, that is, the average value does not satisfy the fourth threshold value condition, then the CDN domain name feature library is established based on the pattern and keyword of the subdomain name string. In the embodiments of the present disclosure, the method for establishing the CDN domain name feature library based on the subdomain name described above can include adding the subdomain name in the domain name list to the CDN domain name feature library.

[0132] Further, in the embodiments of the present disclosure, the method for establishing the CDN domain name feature library based on the pattern of the subdomain name string described above can include determining the target character pattern to which the subdomain name string belongs based on a preset character pattern, and establishing the CDN domain name feature library based on the target character pattern.

[0133] In the embodiments of the present disclosure, the preset character pattern described above includes, but is not limited to, the following character patterns:

[0134] Pattern one, user ID pattern: UUID (Universally Unique Identifier) is a standard format for identifying information. The standard format of UUID is 32 hexadecimal digits, divided into five parts, separated by hyphens, and the pattern is 8-4-4-4-12;

[0135] Pattern two, language and region pattern: Language and region usually consist of a language code and a region code (or country code). The codes above follow international standards (such as ISO 639 and ISO 3166) and are represented in a specific format. For example, the language code and the region code are separated by a hyphen or an underscore, and the format is language-region or language_region, such as Chinese (China) zh-CN or zh_CN;

[0136] Pattern three, date format: The date is defined by combining specific symbols and characters, and each component (such as year, month, and day) is defined. The date pattern can be adjusted according to different application scenarios and regional habits. For example, a common date pattern is 20xx-0x-0x or 0x-0x-20xx.

[0137] Furthermore, in this embodiment of the disclosure, the method for establishing a CDN domain name feature library based on keywords may include: detecting keywords of subdomains, constructing a common keyword library for CDN domain subdomains, matching by keyword traversal, and constructing a CDN domain name feature library for subdomains that match the keywords.

[0138] Furthermore, in this embodiment of the disclosure, after establishing the CDN domain name feature database through the above steps, the CDN domain name feature database can be continuously updated to provide strong data support for subsequent judgment on whether the domain name is hiding the origin server IP through CDN.

[0139] Step 103: Based on the CDN domain name feature library, establish a domain name resolution linked list.

[0140] In this embodiment of the disclosure, after obtaining the CDN domain name feature library through the above steps, a domain name resolution linked list can be established based on the CDN domain name feature library.

[0141] Specifically, in this embodiment of the disclosure, the method for establishing a domain name resolution linked list based on the CDN domain name feature database may include: traversing the DNSRecord table and establishing a time-series doubly linked list based on the resolution time of the domain name field in the DNSRecord table, wherein each node in the time-series doubly linked list includes a CNAME list field and an IP list field. In this embodiment of the disclosure, the CNAME list field and the IP list field may be empty.

[0142] Example, Figure 4 This is a schematic diagram of a time-sequential doubly linked list according to an embodiment of this disclosure. Figure 4 As shown, the time-series doubly linked list corresponding to domain name A includes node 1, node 2, node 3, and node 4. Node 1 includes CNAME list 1, IP list 1, and resolution time 1. Node 2 includes CNAME list 2, IP list 2, and resolution time 2. Node 3 includes CNAME list 3, IP list 3, and resolution time 3. Node 4 includes CNAME list 4, IP list 4, and resolution time 4.

[0143] Furthermore, in this embodiment of the disclosure, a hash table can be used to map the domain name to its corresponding time-series linked list. In this embodiment of the disclosure, when updating the time-series linked list, a hash function is first used to calculate the hash value of the domain name, determine the position of the corresponding time-series linked list, and then a new domain name resolution record is inserted at the end of the linked list.

[0144] It should be noted that in the embodiments of the present disclosure, before the domain name resolving time chain table is established based on the CDN domain name feature library, the above method can further include: filtering the domain names in the CDN domain name feature library through a domain name whitelist to obtain filtered domain names, and establishing the domain name resolving time chain table based on the filtered domain names. The domain name whitelist can be constructed after being confirmed according to the traffic, user quantity and total number of requests of the domain names.

[0145] Step 104, determining the target IP address and the candidate IP address of the target domain name based on the CDN domain name feature library and the domain name resolving time chain table.

[0146] In the embodiments of the present disclosure, after the CDN domain name feature library and the domain name resolving time chain table are obtained through the above steps, the target IP address and the candidate IP address of the target domain name can be determined based on the CDN domain name feature library and the domain name resolving time chain table.

[0147] In one embodiment of the present disclosure, the method of determining the target IP address and the candidate IP address of the target domain name based on the CDN domain name feature library and the domain name resolving time chain table can include the following steps:

[0148] Step 1041, determining the hash value of the target domain name;

[0149] Step 1042, determining the target domain name resolving time chain table of the target domain name based on the hash value of the target domain name;

[0150] Step 1043, determining whether the CNAME list field in the latest node of the target domain name resolving time chain table hits the feature in the CDN domain name feature library;

[0151] Step 1044, if the CNAME list field in the latest node hits the feature in the CDN domain name feature library, determining the target IP address of the target domain name based on the IP list field in the latest node;

[0152] Step 1045, traversing the target domain name resolving time chain table to determine the candidate node and the candidate IP address of the target domain name.

[0153] In the embodiments of the present disclosure, after the target domain name resolving time chain table is determined based on the hash value of the target domain name, the CNAME domain names in the CNAME list field in the latest node (i.e., the node at the end of the chain table) of the target domain name resolving time chain table can be traversed to determine whether they hit the feature in the CDN domain name feature library.

[0154] In the embodiment of the present disclosure, if the CNAME domain name in the CNAME list field hits the feature in the CDN domain name feature library, it indicates that the target domain name has an event of being directed to a CDN domain name for acceleration by a source station, and source station backtracking is needed. At this time, one IP address in the IP list field of the latest node can be selected to determine as the target IP address of the target domain name. Otherwise, source station backtracking is not needed, and the remaining target domain names are analyzed.

[0155] In the embodiment of the present disclosure, after the target IP address is determined, the chain table during the target domain name resolution can be traversed in time forward, and a node with an empty CNAME list field and a non-empty IP list field that is traversed is determined as a candidate node of the target domain name. One IP address in the IP list field of the candidate node can be selected to determine as a candidate IP address of the candidate node. In the embodiment of the present disclosure, if the chain table during the target domain name resolution is traversed and no candidate node meeting the condition is found, the source station IP tracing of the target domain name fails, and the remaining target domain names are analyzed.

[0156] In the embodiment of the present disclosure, the hash value and the domain name time sequence chain table can be used for fast tracing in the memory, so that the storage and searching are efficient, real-time data updating, effective historical data analysis, efficient operation, flexible scalability and multi-dimensional verification are achieved.

[0157] Step 105, determine the page similarity corresponding to the target IP address and the candidate IP address, and determine the candidate IP address corresponding to the page similarity meeting the first threshold condition as the real IP address of the target domain name.

[0158] In the embodiment of the present disclosure, after the target IP address and the candidate IP address are obtained through the above steps, the page similarity corresponding to the target IP address and the candidate IP address can be determined, and the candidate IP address corresponding to the page similarity meeting the first threshold condition is determined as the real IP address of the target domain name.

[0159] In the embodiment of the present disclosure, the method for determining the page similarity corresponding to the target IP address and the candidate IP address, and determining the candidate IP address corresponding to the page similarity meeting the first threshold condition as the real IP address of the target domain name can include the following steps:

[0160] Step 1051, extract the first page DOM (Document Object Model, document object model) framework of the target IP address and the second page DOM framework of the candidate IP address;

[0161] Step 1052, determine the page similarity of the first page DOM framework and the second page DOM framework based on the tree edit distance;

[0162] Step 1053, if the page similarity meets the first threshold condition, the candidate IP address corresponding to the page similarity is determined as the real IP address of the target domain name.

[0163] Step 1054, if the page similarity does not meet the first threshold condition, the candidate IP address of the target domain name is re-determined, and the above steps are repeated until the real IP address of the target domain name is determined or the target domain name corresponding to the target domain name is parsed when the chain list is traversed.

[0164] In the embodiments of the present disclosure, when a website introduces CDN service for acceleration, it can select acceleration modes, including static file acceleration or full-site acceleration mode. Among them, for the content that cannot be hit by the CDN service node, the CDN service node will source to the source station according to the configuration to obtain the content, and return the obtained content to the user side. Based on this, there is a time difference between simulating access to the target IP address and the candidate IP address, and the page content returned by the two may be different, and directly comparing the content will produce missed judgment. Therefore, the first page DOM framework of the target IP address and the second page DOM framework of the candidate IP address can be extracted, and the page similarity analysis is performed through the first page DOM framework and the second page DOM framework, so as to improve the accuracy of source station identification.

[0165] Among them, in the embodiments of the present disclosure, the method for extracting the first page DOM framework of the target IP address can include: retaining the structure and static content in the first page, and eliminating the dynamic content in the first page. Among them, the dynamic content in the first page can include JavaScript code (including inline script and external script reference), dynamically generated content (content generated by JavaScript), dynamic data (such as data loaded by Ajax request), advertising and tracking code (including advertising script and tracking script) and dynamic style (such as style loaded by JavaScript or dynamic CSS). In the embodiments of the present disclosure, the method for extracting the second page DOM framework of the candidate IP address is the same as the above method, and the embodiments of the present disclosure will not be repeated here.

[0166] In addition, in the embodiments of the present disclosure, the tree edit distance is a method for calculating the minimum number of editing operations between two trees. Among them, the editing operations include inserting, deleting and replacing nodes. In addition, the structure of the HTML page can be represented as a tree structure, based on which the tree edit distance can be used to calculate the similarity of two HTML DOM trees. Among them, the method for determining the page similarity of the first page DOM framework and the second page DOM framework based on the tree edit distance is the same as the prior art, and the embodiments of the present disclosure will not be repeated here.

[0167] Further, in the embodiments of the present disclosure, after determining the page similarity through the above method, the page similarity can be normalized to make the range of the page similarity between (0, 1), and the page similarity after normalization is determined as the page similarity of the first page DOM framework and the second page DOM framework.

[0168] In addition, in the embodiments of the present disclosure, if the page similarity is greater than the first threshold, that is, the page similarity satisfies the first threshold condition, at this time, the CDN accelerated page content and the content of the source station are consistent, the candidate IP address corresponding to the page similarity is determined as the real IP address of the target domain name; if the page similarity is less than or equal to the first threshold, that is, the page similarity does not satisfy the first threshold condition, at this time, the candidate IP address of the target domain name will be determined again, and the above steps are repeated until the real IP address of the target domain name is determined or the target domain name resolution chain list traversal is completed.

[0169] Further, in the embodiments of the present disclosure, after determining the real IP address of the target domain name through the above steps, the above method can further include: adding the target domain name and the IP list field in the candidate node of the target domain name into the domain name trace information library, and determining the real IP address of the CDN source station based on the domain name trace information library.

[0170] In the embodiments of the present disclosure, after establishing the domain name trace information library through the above steps, the real source station can be found through the domain name trace information library, so that the actual server location can be tracked and located, thereby providing clues for law enforcement departments, and the network service provider can also be requested to disconnect the network connection of the source station and cut off the network operation of the website.

[0171] It should be noted that the above method can be applied to different CDN service providers and various domain name structures in the embodiments of the present disclosure, and has good compatibility and expansibility, and can be extended and adjusted according to actual needs, and can flexibly cope with various complex network environments and attack means.

[0172] The disclosure provides an IP address identification method of a CDN source station, which comprises collecting user online logs, and establishing a DNS record database based on the online logs; establishing a CDN domain name feature library based on the DNS record database; establishing a domain name resolution time chain table based on the CDN domain name feature library; determining a target IP address and a candidate IP address of a target domain name based on the CDN domain name feature library and the domain name resolution time chain table; determining a page similarity corresponding to the target IP address and the candidate IP address, and determining a candidate IP address corresponding to a page similarity meeting a first threshold condition as a real IP address of the target domain name. Thus, the disclosure can determine the real IP address of the target domain name through the CDN domain name feature library, the page similarity corresponding to the target IP address and the candidate IP address, without making assumptions about domain name features, improving the accuracy of the CDN domain name, and without deploying a server, reducing costs.

[0173] Figure 5 A CDN source station IP address identification device is shown according to some embodiments of the disclosure, as shown in the figure, which can comprise: Figure 5

[0174] A first establishment module 501 is configured to collect user online logs, and establish a DNS record database based on the online logs;

[0175] A second establishment module 502 is configured to establish a CDN domain name feature library based on the DNS record database;

[0176] A third establishment module 503 is configured to establish a domain name resolution time chain table based on the CDN domain name feature library;

[0177] A first determination module 504 is configured to determine a target IP address and a candidate IP address of a target domain name based on the CDN domain name feature library and the domain name resolution time chain table;

[0178] A second determination module 505 is configured to determine a page similarity corresponding to the target IP address and the candidate IP address, and determine a candidate IP address corresponding to a page similarity meeting a first threshold condition as a real IP address of the target domain name.

[0179] In the disclosure, the first establishment module 501 is specifically configured to:

[0180] Collect user online logs through a probe device;

[0181] Parse DNS protocols in the online logs and extract key information;

[0182] Establish a DNS record database based on the key information.

[0183] ​Optionally, in the embodiments of the present disclosure, the CDN domain name feature library comprises a DNSRecord data table; the second establishing module 502 is specifically configured to:

[0184] traverse the CNAME list field in the DNSRecord table to construct a corresponding domain name multi-ary tree;

[0185] determine a target subdomain name in the domain name multi-ary tree and a parent domain name of the target subdomain name;

[0186] traverse the DNSRecord table to obtain a domain name list in the CNAME list that jumps to the parent domain name;

[0187] establish the CDN domain name feature library based on the domain name list.

[0188] Optionally, in the embodiments of the present disclosure, the second establishing module 502 is further configured to:

[0189] determine whether the length of the domain name list meets a second threshold condition;

[0190] if the length of the domain name list meets the second threshold condition, cluster the domain names in the domain name list to obtain a clustering result;

[0191] if the number of clusters in the clustering result does not meet a third threshold condition, calculate an average value of entropy values of all subdomain name strings in the domain name list;

[0192] if the average value meets a fourth threshold condition, establish the CDN domain name feature library based on the subdomain name;

[0193] if the average value does not meet the fourth threshold condition, establish the CDN domain name feature library based on the mode and the keyword of the subdomain name string.

[0194] Optionally, in the embodiments of the present disclosure, the second establishing module 502 is further configured to:

[0195] traverse the domain name list to construct a domain name list matrix;

[0196] take the domain name list matrix as an input of DBSCAN, and perform clustering through DBSCAN to obtain a clustering result.

[0197] Optionally, in the embodiments of the present disclosure, the CDN domain name feature library comprises a DNSRecord data table; the third establishing module 503 is specifically configured to:

[0198] traverse the DNSRecord table, and establish a time sequence double-linked list based on a time of domain name field parsing in the DNSRecord table, wherein each node in the time sequence double-linked list comprises a CNAME list field and an IP list field.

[0199] Optionally, in the embodiments of the present disclosure, the first determining module 504 is specifically configured to:

[0200] determine the hash value of the target domain name;

[0201] determine the target domain name resolution chain table of the target domain name based on the hash value of the target domain name;

[0202] determine whether the CNAME list field in the latest node of the target domain name resolution chain table hits the feature in the CDN domain name feature library;

[0203] if the CNAME list field in the latest node hits the feature in the CDN domain name feature library, determine the target IP address of the target domain name based on the IP list field in the latest node;

[0204] traverse the target domain name resolution chain table to determine the candidate node and the candidate IP address of the target domain name.

[0205] Optionally, in the embodiments of the present disclosure, the second determining module 505 is specifically configured to:

[0206] extract the first page DOM framework of the target IP address and the second page DOM framework of the candidate IP address;

[0207] determine the page similarity of the first page DOM framework and the second page DOM framework based on the tree edit distance;

[0208] if the page similarity meets the first threshold condition, determine the candidate IP address corresponding to the page similarity as the real IP address of the target domain name;

[0209] if the page similarity does not meet the first threshold condition, repeatedly determine the candidate IP address of the target domain name, and repeat the above steps until the real IP address of the target domain name is determined or the target domain name resolution chain table corresponding to the target domain name is traversed.

[0210] Optionally, in the embodiments of the present disclosure, the device is further configured to:

[0211] add the target domain name and the IP list field in the candidate node of the target domain name into the domain name tracing information library;

[0212] determine the real IP address of the CDN source station based on the domain name tracing information library.

[0213] Optionally, in the embodiments of the present disclosure, the device is further configured to:

[0214] filter the domain names in the CDN domain name feature library to obtain filtered domain names;

[0215] establish the domain name resolution chain table based on the filtered domain names.

[0216] like Figure 6 As shown, the electronic device 600 includes a computing unit 601, which can perform various appropriate actions and processes based on a computer program stored in a read-only memory (ROM) 602 or a computer program loaded from a storage unit 608 into a random access memory (RAM) 603. The RAM 603 may also store various programs and data required for the operation of the electronic device 600. The computing unit 601, ROM 602, and RAM 603 are interconnected via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0217] Multiple components in electronic device 600 are connected to I / O interface 605, including: input unit 606, such as keyboard, mouse, etc.; output unit 607, such as various types of displays, speakers, etc.; storage unit 608, such as disk, optical disk, etc.; and communication unit 609, such as network card, modem, wireless transceiver, etc. Communication unit 609 allows electronic device 600 to exchange information / data with other electronic devices through computer networks such as the Internet and / or various telecommunications networks.

[0218] The computing unit 601 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 601 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 601 performs the various methods and processes described above, such as the method for identifying the IP address of a CDN origin server. For example, in some embodiments, the method for identifying the IP address of a CDN origin server can be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 608. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 600 via ROM 602 and / or communication unit 609. When the computer program is loaded into RAM 603 and executed by the computing unit 601, one or more steps of the method for identifying the IP address of a CDN origin server described above can be performed. Alternatively, in other embodiments, the computing unit 601 may be configured to perform an IP address identification method for a CDN origin server by any other suitable means (e.g., by means of firmware).

[0219] Various implementations of the above described apparatus and techniques of this document can be realized in digital electronic circuitry, integrated circuitry, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on a chip (SOC), a programmable logic electronic device (CPLD), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable apparatus including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage apparatus, at least one input apparatus, and at least one output apparatus.

[0220] Program code for carrying out methods of the present disclosure can be written in any combination of one or more programming languages. The program code can be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the program code, when executed by the processor or controller, produces the functions / operations specified in the flowcharts and / or the block diagrams. The program code can be executed entirely on a machine, partially on a machine, partially on a machine as a stand-alone software package, partially on a machine and partially on a remote machine or entirely on a remote machine or server.

[0221] In the context of this disclosure, a machine-readable medium can be a tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or electronic device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include but is not limited to an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or electronic device, or any suitable combination of the foregoing. More specific examples of the machine-readable storage medium will include one or more of: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0222] To provide for interaction with a user, the devices and techniques described here can be implemented on a computer having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the computer. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0223] The devices and techniques described here can be implemented in a computing device that includes a back end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front end component (e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the devices and techniques described here), or any combination of such back end, middleware, or front end components. The components of the device can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), the Internet, and a blockchain network.

[0224] The computer device can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. A server can be a cloud server, also known as cloud computing server or cloud host, which is a host product in the cloud computing service system, to solve the defects of large management difficulty and weak business scalability in traditional physical host and VPS service ("Virtual Private Server", or simply "VPS"). The server can also be a server of a distributed device, or a server combined with a blockchain.

[0225] It should be understood that the various forms of flow shown above can be re-ordered, added to, or deleted from without departing from the scope of the present disclosure. For example, the steps recited in the present disclosure can be executed in parallel, executed in series, or executed in different orders, without departing from the desired results of the technical solutions of the present disclosure, and are not limited herein.

[0226] The above detailed description does not limit the scope of the disclosure. Various modifications, combinations, sub-combinations and alternatives can be made to the detailed description. Any modification, equivalent replacement and improvement etc. made within the spirit and principle of the disclosure shall be included in the scope of the disclosure.

Claims

1. A CDN source station IP address identification method, characterized in that, The method comprises: collecting user Internet log and establishing a domain name system (DNS) record database based on the Internet log; based on the DNS record database, establishing a CDN domain name feature library, wherein the CDN domain name feature library comprises a DNSRecord data table; traversing the DNSRecord data table and establishing a time sequence double-direction linked list based on the time of domain name field resolution in the DNSRecord data table, wherein each node in the time sequence double-direction linked list comprises a CNAME list field and an IP list field; determining the hash value of a target domain name; based on the hash value of the target domain name, determining the target time sequence double-direction linked list of the target domain name; determining whether the CNAME list field in the latest node of the target time sequence double-direction linked list hits the feature in the CDN domain name feature library; if the CNAME list field in the latest node hits the feature in the CDN domain name feature library, determining the target IP address of the target domain name based on the IP list field in the latest node; traversing the target time sequence double-direction linked list to determine the candidate node of the target domain name and the candidate IP address; determining the page similarity of the target IP address and the candidate IP address, and determining the candidate IP address corresponding to the page similarity meeting the first threshold condition as the real IP address of the target domain name.

2. The method of claim 1, wherein, The collection of user Internet log and the establishment of DNS record database based on the Internet log comprise: collecting the user's Internet log through a probe device; parsing the DNS protocol in the Internet log and extracting key information; based on the key information, establishing a DNS record database.

3. The method of claim 1, wherein, The CDN domain name feature library comprises a DNSRecord data table; and the establishment of the CDN domain name feature library based on the DNS record database comprises: traversing the canonical name CNAME list field in the DNSRecord table to construct a corresponding domain name multi-ary tree; determining the target subdomain name in the domain name multi-ary tree and the parent domain name of the target subdomain name; traversing the DNSRecord table to obtain a domain name list in the CNAME list jumping to the parent domain name; based on the domain name list, establishing a CDN domain name feature library.

4. The method of claim 3, wherein, The establishment of the CDN domain name feature library based on the domain name list comprises: determining whether the length of the domain name list meets the second threshold condition; if the length of the domain name list meets the second threshold condition, clustering the domain names in the domain name list to obtain a clustering result; if the number of clusters in the clustering result does not meet the third threshold condition, calculating the average value of the entropy values of all subdomain name strings in the domain name list; if the average value meets the fourth threshold condition, establishing a CDN domain name feature library based on the subdomain name; if the average value does not meet the fourth threshold condition, establishing a CDN domain name feature library based on the pattern and key word of the subdomain name string.

5. The method of claim 4, wherein, The clustering of the domain names in the domain name list to obtain a clustering result comprises: traversing the domain name list to construct a domain name list matrix; The domain name list matrix is taken as an input of a density-based spatial clustering method DBSCAN with noise, and clustering is performed by the DBSCAN to obtain a clustering result.

6. The method of claim 1, wherein, The method further includes: extracting a first page document object model (DOM) framework of the target IP address and a second page DOM framework of the candidate IP address; determining a page similarity of the first page DOM framework and the second page DOM framework based on a tree edit distance; if the page similarity meets a first threshold condition, determining the candidate IP address corresponding to the page similarity as a real IP address of the target domain name; if the page similarity does not meet the first threshold condition, re-determining the candidate IP address of the target domain name, and repeating the above steps until the real IP address of the target domain name is determined or the target time-sequential bidirectional linked list corresponding to the target domain name is completely traversed.

7. The method of claim 1, wherein, The method further includes: adding the target domain name and an IP list field in a candidate node of the target domain name into a domain name tracing information library; determining a real IP address of a CDN source station based on the domain name tracing information library.

8. The method of claim 1, wherein, The method further includes: filtering domain names in the CDN domain name feature library based on a domain name whitelist to obtain filtered domain names; establishing a time-sequential bidirectional linked list based on the filtered domain names.

9. An IP address identifying apparatus of a CDN origin server, characterized by, The apparatus includes: a first establishing module configured to collect user online logs and establish a DNS record database based on the online logs; a second establishing module configured to establish a CDN domain name feature library based on the DNS record database, the CDN domain name feature library including a DNSRecord data table; a third establishing module configured to traverse the DNSRecord data table and establish a time-sequential bidirectional linked list based on time of domain name field resolution in the DNSRecord data table, wherein each node in the time-sequential bidirectional linked list includes a CNAME list field and an IP list field; a first determining module configured to determine a hash value of a target domain name, determine a target time-sequential bidirectional linked list of the target domain name based on the hash value of the target domain name, determine whether the CNAME list field in a latest node of the target time-sequential bidirectional linked list hits a feature in the CDN domain name feature library, determine a target IP address of the target domain name based on the IP list field in the latest node if the CNAME list field in the latest node hits the feature in the CDN domain name feature library, and traverse the target time-sequential bidirectional linked list to determine a candidate node of the target domain name and a candidate IP address; a second determining module configured to determine a page similarity corresponding to the target IP address and the candidate IP address, and determine a candidate IP address corresponding to a page similarity meeting a first threshold condition as a real IP address of the target domain name. 10.A non-transitory computer-readable storage medium storing computer-executable instructions; when the computer-executable instructions are executed by a processor, the method of any one of claims 1-8 is implemented. 11.A computer program product comprising a computer program which, when executed by a processor, implements the method of any one of claims 1-8.

Images