Domain name quick matching method and device

Abstract

The invention discloses a domain name quick matching method and device, and the method comprises the steps: preprocessing: obtaining a blacklist domain name set which stores potential malicious domain names, and preprocessing the blacklist domain names into a minimum deterministic automatic state machine; configuration generation: generating a configuration file for reducing memory according to the minimization determinacy automatic state machine; and performing matching judgment: performing matching judgment on the domain names flowing through in real time by using the state transition table in the configuration file to obtain a matching result. According to the method and the device, memory occupation can be remarkably reduced, and meanwhile, matching efficiency and accuracy are improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a domain name fast matching method and device. Background Art

[0002] In today's increasingly digital and networked society, network security issues are particularly important, especially the detection of malicious domain names. Malicious domain names are often used to launch phishing attacks, spread malware, and conduct other illegal network activities. Therefore, effective domain name detection technology is crucial to preventing these attacks, which is directly related to the data security of end users and the overall health of the network environment.

[0003] Currently, common methods for domain name detection include exact matching, prefix tree matching, and regular matching.

[0004] Exact matching is a method of identifying malicious domain names by completely matching user input with a list of known malicious domain names. This method is simple and direct, but its main disadvantage is that it cannot identify slightly changed or newly emerging malicious domain names, showing its lack of flexibility and adaptability.

[0005] Prefix tree matching improves retrieval efficiency by using a tree structure to store common prefixes, and is suitable for processing a large number of domain names with common prefixes. However, this method consumes a lot of memory when processing domain name data that changes dynamically and in large quantities.

[0006] Regular matching detects domain names by defining a series of matching rules, which has a certain degree of flexibility. However, complex regular expressions consume more computing resources when executed, and as the number of rules increases, performance is often difficult to effectively scale linearly.

[0007] In a domain name matching method, device, electronic device and storage medium disclosed in the patent application with application number CN202310890305.3, a domain name matching technology combining a prefix tree and a suffix tree is proposed, specifically: obtaining a domain name to be matched and a domain name filter list set; constructing a prefix tree according to a first preset domain name set in the domain name filter list set; constructing a suffix tree according to a second preset domain name set in the domain name filter list set; matching the domain name to be matched with the prefix tree and / or suffix tree to obtain a matching result. This domain name matching technology significantly improves the efficiency of domain name matching by making full use of the advantages of prefix trees and suffix trees. Although this combined method has achieved good results in improving efficiency, its memory consumption and processing speed are still a challenge that needs to be overcome when processing large-scale data.

[0008] In general, although existing technologies have made progress in domain name matching speed and processing of known malicious samples, they still face challenges in quickly identifying new malicious domain names and improving memory efficiency. The existence of these problems suggests that people need to develop more efficient and less memory-intensive domain name detection methods to cope with evolving network threats and improve system security and responsiveness. Summary of the invention

[0009] In view of the above, an object of the present invention is to provide a domain name fast matching method and device, which can significantly reduce memory usage while improving matching efficiency and accuracy.

[0010] To achieve the above-mentioned purpose of the invention, an embodiment provides a domain name fast matching method, comprising the following steps: Preprocessing: Obtain a blacklist domain name set storing potential malicious domain names, and preprocess the blacklist domain names into a minimized deterministic automatic state machine; Configuration generation: Generates memory-reduced configuration files based on minimized deterministic automatic state machines; Matching judgment: Use the state transfer table in the configuration file to match the domain names flowing through in real time to obtain the matching result.

[0011] Preferably, the blacklist domain name is preprocessed into a minimized deterministic automatic state machine, including: Traverse each character in the blacklist domain name set, generate a deterministic automatic state machine node, and ensure that the generated deterministic automatic state machine is minimized to obtain a minimized deterministic automatic state machine.

[0012] Preferably, generating a configuration file for reducing memory based on a minimized deterministic state machine includes: The state transition matrix of the deterministic automatic state machine is traversed and minimized to regenerate the configuration file in a space-compressed format to reduce the size of the configuration file.

[0013] Preferably, the generated configuration file contains the following: The smallest unit is 4 bytes, where 0xFF000000 is an unacceptable status header, 0xFF000001 is an accepted status header, the high 8 bits of the other 4 bytes represent the status transfer character, and the low 24 bits represent the offset position of the status header after the transfer in the configuration file, and the offset position is also in units of 4 bytes.

[0014] Preferably, the state transition table in the configuration file is used to match the domain name flowing through in real time to obtain a matching result, including: The domain names to be matched that are flowing in real time are matched with the state transition table in the configuration file in sequence, starting from state No. 0. If the domain name to be matched has not been read completely, a character is read in and the transition table of the current state is checked. If there is a corresponding transition character, the corresponding state is transferred, otherwise the match fails. Repeat the above process until the domain name to be matched is read completely, then check whether the current state is the accepting state. If the current state is the accepting state, the match succeeds, otherwise the match fails.

[0015] To achieve the above-mentioned purpose, the embodiment of the present invention provides a domain name fast matching device, including: A preprocessing module, which is used to obtain a blacklist domain name set storing potential malicious domain names, and preprocess the blacklist domain names into a minimized deterministic automatic state machine; A configuration generation module for generating a configuration file with reduced memory based on a minimized deterministic automatic state machine; The matching judgment module is used to use the state transfer table in the configuration file to match the domain name flowing through in real time to obtain a matching result.

[0016] To achieve the above-mentioned purpose of the invention, an embodiment of the present invention further provides a computing device, including a memory and one or more processors, wherein the memory stores executable code, and when the one or more processors execute the executable code, they are used to implement the above-mentioned domain name fast matching method.

[0017] To achieve the above-mentioned purpose of the invention, an embodiment of the present invention further provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, the above-mentioned domain name fast matching method is implemented.

[0018] To achieve the above-mentioned purpose of the invention, an embodiment of the present invention further provides a computer product, which includes a computer program. When the computer program is executed by a processor, the above-mentioned domain name fast matching method is implemented.

[0019] Compared with the prior art, the present invention has the following beneficial effects: First, the present invention significantly reduces memory usage, which is specifically reflected in the fact that the runtime memory is only 61.53% of the size of the original blacklist domain name data set. This optimization is achieved by using a minimized deterministic automatic state machine (DFA) and data compression technology, which effectively reduces the redundancy of the data storage structure. The reduced memory requirement not only improves the system operation efficiency, but also reduces the dependence on hardware resources, making the present invention suitable for deployment in resource-constrained environments.

[0020] At the same time, the present invention greatly improves the matching efficiency and can complete the matching of a large number of domain names in a very short time. Specifically, the matching time of 10,000 domain names is only 6.28 milliseconds. The optimized state machine structure and efficient algorithm design make the domain name matching process fast, meeting the demand for real-time data processing in a high-speed network environment.

[0021] In addition, the matching method of minimizing the deterministic automatic state machine enables the present invention to ensure the ability of accurate domain name matching while using low memory and high efficiency, which is crucial for effectively preventing complex network threats such as phishing and malware distribution. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0023] Figure 1 is a flow chart of a domain name fast matching method provided by an embodiment; Figure 2 It is a schematic diagram of the composition of the configuration file provided in the embodiment; Figure 3 It is a schematic diagram of the structure of a domain name fast matching device provided in an embodiment. DETAILED DESCRIPTION

[0024] To make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific implementation methods described herein are only used to explain the present invention and do not limit the scope of protection of the present invention.

[0025] The inventive concept of the present invention is to solve the technical problems of excessive memory usage, low matching efficiency, and insufficient matching accuracy in the domain name matching method in the prior art when processing large-scale and dynamically changing malicious domain name data. The embodiment of the present invention provides a domain name fast matching method and device, which can more effectively deal with a large number of constantly changing malicious domain names, ensure that network security technology can adapt to future development needs, and improve the reliability and real-time performance of malicious domain name detection. This will help the network security system to reduce the burden on hardware resources while maintaining efficient operation and improve the overall system performance.

[0026] like Figure 1 As shown, a domain name fast matching method provided in the embodiment realizes efficient and accurate real-time malicious domain name detection through the collaborative work of the following three steps, specifically including: S1, preprocessing: obtain a blacklist domain name set storing potential malicious domain names, and preprocess the blacklist domain names into a minimized deterministic automatic state machine.

[0027] In the embodiment, a blacklist domain name set storing potential malicious domain names is first read, and then a minimized deterministic automatic state machine (DFA) generation algorithm is used to pre-process these blacklist domain names to convert the original blacklist domain names into a highly optimized minimized DFA, which retains all the information of the original domain name list, while maintaining matching accuracy, greatly reducing the required storage space and improving the processing speed.

[0028] Specifically, traverse each character in the blacklist domain name set, generate a deterministic automatic state machine node, and use an algorithm to ensure that the generated deterministic automatic state machine is minimized to obtain a minimized deterministic automatic state machine. The algorithm can refer to the literature (Jan Daciuk, Stoyan Mihov, Bruce Watson, and Richard Watson, Incremental Construction of Minimal Acyclic Finite State Automata, Computational Linguistics, 26(1), March 2000.) S2, configuration generation: Generates memory-reduced configuration files based on minimized deterministic automatic state machines.

[0029] In the embodiment, in the configuration generation step, the minimized deterministic automatic state machine is further converted into a configuration file suitable for practical applications. An optimized state machine data structure can be used to significantly reduce the size of the configuration file through data compression technology and state optimization algorithm, further reducing the memory usage of the matching system when it is running.

[0030] Specifically, the state transition matrix of the minimized deterministic automatic state machine is traversed, and the configuration file is regenerated in a space-compressed format to reduce the size of the configuration file. The generated configuration file contains the following content: 4 bytes are used as the minimum unit, where 0xFF000000 is an unacceptable state header, 0xFF000001 is an accepted state header, the high 8 bits of the other 4 bytes represent the state transfer character, and the low 24 bits represent the offset position of the state header after the transfer in the configuration file (in units of 4 bytes).

[0031] S3, match judgment: use the state transfer table in the configuration file to match the domain name flowing through in real time to obtain the matching result.

[0032] In the embodiment, the matching judgment is deployed in the actual environment, responsible for loading the configuration files created by the configuration generation step, and using these configuration files to match the domain names flowing through in real time. By utilizing the minimized DFA generated by the preprocessing step, the matching judgment step can quickly determine whether any given domain name is a malicious domain name, thereby achieving efficient and accurate domain name matching. The design of matching judgment allows real-time detection and response to potential network security threats without affecting network performance.

[0033] Specifically, the domain names to be matched that are flowing through in real time are matched with the state transition table in the configuration file in sequence, starting from state No. 0. If the domain name to be matched has not been read completely, a character is read in and the transition table of the current state is checked. If a corresponding transition character exists, the corresponding state is entered, otherwise the matching fails. The above process is repeated until the domain name to be matched is read completely, then it is checked whether the current state is an accepting state. If the current state is an accepting state, the matching is successful, otherwise the matching fails.

[0034] For example, the structure of the configuration file is as follows Figure 2 As shown, assuming that a domain name list containing a.com and a.com.cn is used to construct a minimized automatic state machine, the meaning of the configuration file obtained is as follows Figure 2 shown.

[0035] When a.com needs to be matched, it starts from state offset 0 and transfers to state offset 2, 4, 6, and 8 in sequence according to the transfer table. At this time, the domain name is read and state 8 is checked as an acceptance state, so a.com is matched successfully; When b.com needs to be matched, it starts from state offset 0. Since there is no state transition of character b at this time, the match fails. When a.com.cn needs to be matched, it starts from state offset 0 and transfers to state offset 2, 4, 6, 8, 10, 12, 14, and 16 in sequence according to the transfer table. At this time, the domain name is read and state 16 is checked as an acceptance state, so a.com.cn is matched successfully.

[0036] Through the above steps S1-S3, matching is performed according to the configuration file of the generated minimized deterministic automatic state machine, which can ensure a matching effect that is completely consistent with the original list of domain names to be matched, while greatly reducing the memory usage and time overhead of the matching program. For systems with a large number of real-time matching requirements, a complete, reliable, real-time and efficient matching effect can also be achieved.

[0037] like Figure 3As shown, a domain name fast matching device 30 provided in the embodiment includes a preprocessing module 31, a configuration generation module 32, and a matching judgment module 33, wherein the preprocessing module 31 is used to obtain a blacklist domain name set storing potential malicious domain names, and preprocess the blacklist domain names into a minimized deterministic automatic state machine; the configuration generation module 32 is used to generate a configuration file for reducing memory according to the minimized deterministic automatic state machine; the matching judgment module 33 is used to use the state transition table in the configuration file to perform matching judgment on the domain names flowing through in real time to obtain matching results.

[0038] In the preprocessing module 31, the blacklist domain name is preprocessed into a minimized deterministic automatic state machine, including: traversing each character in the blacklist domain name set, generating a deterministic automatic state machine node, and ensuring that the generated deterministic automatic state machine is minimized to obtain a minimized deterministic automatic state machine.

[0039] In the configuration generation module 32, a configuration file for reducing memory is generated according to the minimized deterministic automatic state machine, including: traversing the state transition matrix of the minimized deterministic automatic state machine, and regenerating the configuration file in a space-compressed format to reduce the size of the configuration file. The generated configuration file includes the following content: 4 bytes are used as the minimum unit, where 0xFF000000 is an unacceptable state header, 0xFF000001 is an accepted state header, the high 8 bits of the other 4 bytes represent the state transfer character, and the low 24 bits represent the offset position of the state header after the transfer in the configuration file, and the offset position is also in units of 4 bytes.

[0040] In the matching judgment module 33, the state transition table in the configuration file is used to match the domain name flowing through in real time to obtain a matching result, including: matching the domain name to be matched flowing through in real time with the state transition table in the configuration file in sequence, starting from state No. 0, if the domain name to be matched has not been read completely, then read in a character, check the transfer table of the current state, and if there is a corresponding transfer character, transfer to the corresponding state, otherwise the matching fails; repeat the above process until the domain name to be matched is read completely, then check whether the current state is an accepting state, if the current state is an accepting state, the matching is successful, otherwise the matching fails.

[0041] It should be noted that the domain name fast matching device provided in the above embodiment should be illustrated by the division of the above functional modules when performing domain name fast matching. The above functional distribution can be completed by different functional modules as needed, that is, the internal structure of the terminal or server is divided into different functional modules to complete all or part of the functions described above. In addition, the domain name fast matching device provided in the above embodiment belongs to the same concept as the domain name fast matching method embodiment. The specific implementation process is detailed in the domain name fast matching method embodiment, which will not be repeated here.

[0042] The device of the present invention not only provides extremely low memory usage and efficient processing speed through the combination of these three modules, but also provides the ability to accurately match domain names, which is particularly suitable for network security application scenarios that require processing of large amounts of data and have high real-time requirements. Through the implementation of the present invention, the detection capability of malicious domain names can be significantly improved, providing a safer and more efficient protection for the network environment.

[0043] Based on the same inventive concept, an embodiment further provides a computing device, including a memory and one or more processors, wherein executable code is stored in the memory, and when the one or more processors execute the executable code, the method for fast matching a domain name is implemented, specifically including the following steps: S1, preprocessing: obtaining a blacklist domain name set storing potential malicious domain names, and preprocessing the blacklist domain names into a minimized deterministic automatic state machine; S2, configuration generation: Generates memory-reduced configuration files based on minimized deterministic automatic state machines; S3, match judgment: use the state transfer table in the configuration file to match the domain name flowing through in real time to obtain the matching result.

[0044] The computing device provided in the embodiment, in addition to the processor and memory, also includes hardware required for other services such as internal bus, network interface, memory, etc. at the hardware level. The memory is a non-volatile memory, and the processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to implement the method for constructing a human-computer interaction cognitive model based on ergonomics described in S1-S3 above. Of course, in addition to software implementation, the present invention does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0045] Based on the same inventive concept, an embodiment further provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, the above domain name fast matching method is implemented, which specifically includes the following steps: S1, preprocessing: obtaining a blacklist domain name set storing potential malicious domain names, and preprocessing the blacklist domain names into a minimized deterministic automatic state machine; S2, configuration generation: Generates memory-reduced configuration files based on minimized deterministic automatic state machines; S3, match judgment: use the state transfer table in the configuration file to match the domain name flowing through in real time to obtain the matching result.

[0046] In the embodiment, computer-readable media include permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. The information can be computer-readable instructions, data structures, program modules or other data.

[0047] The specific implementation methods described above provide a detailed description of the technical solutions and beneficial effects of the present invention. It should be understood that the above is only the most preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, supplements and equivalent substitutions made within the scope of the principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A domain name fast matching method, characterized in that: The following steps are involved: Preprocessing: Obtain a blacklist domain name set storing potential malicious domain names, and preprocess the blacklist domain names into a minimized deterministic automatic state machine; Configuration generation: Generates memory-reduced configuration files based on minimized deterministic automatic state machines; Matching judgment: Use the state transfer table in the configuration file to match the domain names flowing through in real time to obtain the matching result.

2. The domain name fast matching method according to claim 1, characterized in that: Preprocess the blacklisted domain name into a minimal deterministic automatic state machine, including: Traverse each character in the blacklist domain name set, generate a deterministic automatic state machine node, and ensure that the generated deterministic automatic state machine is minimized to obtain a minimized deterministic automatic state machine.

3. The domain name fast matching method according to claim 1, characterized in that: Generates a reduced memory profile based on a minimized deterministic state machine, including: The state transition matrix of the deterministic automatic state machine is traversed and minimized to regenerate the configuration file in a space-compressed format to reduce the size of the configuration file.

4. The domain name fast matching method according to claim 1 or 3, characterized in that: The generated configuration file contains the following: The smallest unit is 4 bytes, where 0xFF000000 is an unacceptable status header, 0xFF000001 is an accepted status header, the high 8 bits of the other 4 bytes represent the status transfer character, and the low 24 bits represent the offset position of the status header after the transfer in the configuration file, and the offset position is also in units of 4 bytes.

5. The domain name fast matching method according to claim 1, characterized in that: Use the state transition table in the configuration file to match the domain name that passes through in real time to obtain the matching results, including: The domain names to be matched that are flowing in real time are matched with the state transition table in the configuration file in sequence, starting from state No.

0. If the domain name to be matched has not been read completely, a character is read in and the transition table of the current state is checked. If there is a corresponding transition character, the corresponding state is transferred, otherwise the match fails. Repeat the above process until the domain name to be matched is read completely, then check whether the current state is the accepting state. If the current state is the accepting state, the match succeeds, otherwise the match fails.

6. A domain name fast matching device, characterized in that: include: A preprocessing module, which is used to obtain a blacklist domain name set storing potential malicious domain names, and preprocess the blacklist domain names into a minimized deterministic automatic state machine; A configuration generation module for generating a configuration file with reduced memory based on a minimized deterministic automatic state machine; The matching judgment module is used to use the state transfer table in the configuration file to match the domain name flowing through in real time to obtain a matching result.

7. A computing device comprising a memory and one or more processors, wherein the memory stores executable code, characterized in that: When the one or more processors execute the executable code, they are used to implement the domain name fast matching method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that: A program is stored thereon, and when the program is executed by a processor, the domain name fast matching method described in any one of claims 1 to 5 is implemented.

9. A computer product comprising a computer program, characterized in that When the computer program is executed by a processor, the domain name fast matching method according to any one of claims 1 to 5 is implemented.

Images