CDN domain name classification processing method and device, equipment, storage medium and product

Abstract

The embodiment of the invention provides a CDN domain name classification processing method and device, equipment, a storage medium and a product. Comprising the following steps: receiving DNS analysis data sent by network access equipment; constructing an analysis graph according to the DNS analysis data; in the analysis graph, according to the incidence relation between each CNAME domain name and the user domain name, the incidence relation between each CNAME domain name and the CNAME secondary domain name, and the incidence relation between the user domain name and the IP address, the detection characteristics of each CNAME domain name are extracted; according to each CNAME domain name, extracting a text feature of each CNAME domain name; obtaining an unmarked feature set of each CNAME domain name according to the detection features and the text features; and inputting the unmarked feature set of all CNAME domain names into a pre-trained classifier to output a content delivery network (CDN) domain name classification result. The method is used for achieving the effect of improving the robustness of domain name classification.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a CDN domain name classification processing method, device, equipment, storage medium and product. Background Art

[0002] CDN (Content Delivery Network) distributes source site content to acceleration nodes around the world. When a user initiates a website resource request to a source domain website through a source domain name, the request will be dispatched to the node closest to the user, increasing the user's network access speed. For content providers, their source domain names belong to their assets, while the CNAME (Canonical Name) domain name used to achieve content distribution is controlled and resolved by the CDN provider. Therefore, when performing asset mapping, it is necessary to distinguish between the domain name belonging to the content provider and the CNAME domain name belonging to the CDN provider.

[0003] In the prior art, CDN domain name classification generally extracts statistical features related to the domain name for detection. However, during the implementation process, due to the complexity of the existing network, the statistical features may be offset and thus affect the classification effect. Summary of the invention

[0004] The embodiments of the present application provide a CDN domain name classification processing method, apparatus, device, storage medium and product to achieve the effect of improving the robustness of domain name classification.

[0005] In a first aspect, an embodiment of the present application provides a CDN domain name classification processing method, which is applied to a domain name classification system, including: receiving domain name system DNS resolution data sent by a network access device; constructing a resolution graph according to the DNS resolution data, wherein the nodes of the resolution graph include user domain names, canonical name CNAME domain names, CNAME second-level domain names, and Internet Protocol IP addresses; in the resolution graph, based on the association relationship between each CNAME domain name and the user domain name, the association relationship between each CNAME domain name and the CNAME second-level domain name, and the association relationship between the user domain name and the IP address, extracting the detection features of each CNAME domain name; based on each CNAME domain name, extracting the text features of each CNAME domain name; based on the detection features and the text features, obtaining an unlabeled feature set of each CNAME domain name; inputting the unlabeled feature set of all CNAME domain names into a pre-trained classifier to output a content distribution network CDN domain name classification result.

[0006] In a possible implementation, the process of constructing a resolution graph includes: obtaining a user domain name obtained by resolving a domain name by a client in DNS resolution data as a user domain name node; according to the user domain name, querying a corresponding CNAME record in a network access device to obtain a CNAME domain name as a CNAME domain name node; determining each IP address according to an IP address list obtained by resolving the user domain name by the network access device as an IP address node; using a CNAME second-level domain name obtained according to the second-level domain name corresponding to the CNAME domain name as a CNAME second-level domain name node; determining the user domain name node, CNAME domain name node, IP address node and CNAME second-level domain name node as a node set; establishing an edge between the user domain name node and the CNAME domain name node corresponding to the user domain name; establishing an edge between the user domain name node and the IP address node corresponding to the user domain name; establishing an edge between the CNAME domain name node and the CNAME second-level domain name node corresponding to the CNAME domain name; determining all established edges as an edge set; and constructing a resolution graph based on the node set and the edge set.

[0007] In a possible implementation, the detection features include a first feature, a second feature, a third feature, a fourth feature, a fifth feature, and a sixth feature; accordingly, the detection features of each CNAME domain name are extracted, including: in the parsing graph, according to the edges and nodes connected to each CNAME domain name node, determining the minimum connected subgraph of each CNAME; obtaining the number of nodes in the minimum connected subgraph of each CNAME domain name node to determine the first feature; obtaining all CNAME second-level domain name nodes connected to each CNAME domain name node to obtain a CNAME second-level domain name set; obtaining the number of all CNAME domain name nodes connected to all CNAME second-level domain name nodes in the CNAME second-level domain name set to determine the second feature; according to all CNAME AME domain name node, determine the CNAME domain name set, and obtain the number of all user domain name nodes connected to all CNAME domain name nodes in the CNAME domain name set to determine the third feature; determine the user domain name set based on all user domain name nodes, and obtain the number of all IP address nodes connected to all user domain name nodes in the user domain name set to determine the fourth feature; obtain the number of all user domain name nodes connected to each CNAME domain name node to determine the fifth feature; obtain the number of secondary domain names of all user domain names connected to each CNAME domain name node to determine the sixth feature; determine the first feature, the second feature, the third feature, the fourth feature, the fifth feature and the sixth feature as the detection features of each CNAME domain name.

[0008] In a possible implementation, the text features include a seventh feature, an eighth feature, a ninth feature, a tenth feature, an eleventh feature, and a twelfth feature; accordingly, extracting the text features of each CNAME domain name includes: obtaining the string length of each CNAME domain name, determining it as the seventh feature; obtaining the number of dots in each CNAME domain name, determining it as the eighth feature; obtaining the number of underscores in each CNAME domain name, determining it as the ninth feature; obtaining the number of numbers in each CNAME domain name, determining it as the tenth feature; obtaining the second-level domain names of all user domain names connected to each CNAME domain name node, and determining the number of nodes whose second-level domain names are the same as the second-level domain names of each CNAME domain name; determining the eleventh feature based on the ratio of the number of nodes to the fifth feature; determining the twelfth feature based on the prefix of each CNAME domain name and all user domain names connected to each CNAME domain name node; and determining the seventh feature, the eighth feature, the ninth feature, the tenth feature, the eleventh feature, and the twelfth feature as the text features of each CNAME domain name.

[0009] In a possible implementation, determining the twelfth feature includes: if the prefix of each CNAME domain name is the same as the prefix of any user domain name in all user domain names connected to each CNAME domain name node, then determining the twelfth feature to be 1; if the prefix of each CNAME domain name is different from the prefix of all user domain names connected to each CNAME domain name node, then determining the twelfth feature to be 0.

[0010] In a possible implementation, the training process of the classifier includes: constructing an initial CDN domain name suffix library, wherein the initial CDN domain name suffix library is empty; collecting CDN domain name suffix data based on preset rules, and storing the CDN domain name suffix data in the CDN domain name suffix library; matching the DNS resolution log sent by the network access device according to the CDN domain name suffix library to obtain a preliminarily identified CDN domain name; extracting detection features and text features of the preliminarily identified CDN domain name; inputting the detection features and text features of the preliminarily identified CDN domain name into the initial PU-learning classifier to train the PU-learning classifier; using the PU-learning classifier to classify multiple domain names to output detection results; for the domain name marked as a CDN domain name in the detection result, sending an active request to the DNS server to determine whether the domain name uses CDN; if the domain name uses CDN, updating the suffix information of the domain name to the CDN domain name suffix library, wherein the CDN domain name suffix library is used to iteratively train the PU-learning classifier to obtain a pre-trained classifier.

[0011] In a second aspect, an embodiment of the present application provides a CDN domain name classification processing device, which is applied to a domain name classification system, including:

[0012] The data receiving module is used to receive the domain name system DNS resolution data sent by the network access device.

[0013] The resolution graph construction module is used to construct a resolution graph based on DNS resolution data, wherein the nodes of the resolution graph include user domain names, canonical name CNAME domain names, CNAME secondary domain names and Internet Protocol IP addresses.

[0014] The detection feature extraction module is used to extract the detection features of each CNAME domain name in the analysis graph according to the association relationship between each CNAME domain name and the user domain name, the association relationship between each CNAME domain name and the CNAME secondary domain name, and the association relationship between the user domain name and the IP address.

[0015] The text feature extraction module is used to extract the text features of each CNAME domain name according to each CNAME domain name.

[0016] The unmarked feature set determination module is used to obtain the unmarked feature set of each CNAME domain name according to the detection feature and the text feature.

[0017] The classification result output module is used to input the unlabeled feature set of all CNAME domain names into the pre-trained classifier to output the content distribution network CDN domain name classification result.

[0018] In a third aspect, an embodiment of the present application provides a domain name classification system, including: a memory, a processor; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory, so that the processor executes the first aspect above and / or various possible implementations of the first aspect.

[0019] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementations of the first aspect.

[0020] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementation methods of the first aspect.

[0021] The CDN domain name classification processing method, device, equipment, storage medium and product provided in the embodiment of the present application build a resolution graph based on DNS data, describe the association between different types of domain names and IP addresses in the domain name resolution process, extract detection features and text features based on the resolution graph and the text content of the CNAME record, and finally use a pre-trained classifier to classify the domain name and output the CDN domain name classification result. Feature extraction based on the association relationship reflected in the resolution graph avoids the data offset that may be introduced by simple statistical features and improves the robustness of domain name classification. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0023] Figure 1 A schematic diagram of a scenario of a CDN domain name classification processing method provided in an embodiment of the present application;

[0024] Figure 2 A flowchart of the CDN domain name classification processing method provided for this application;

[0025] Figure 3 A schematic diagram of the structure of a CDN domain name classification processing device provided in an embodiment of the present application;

[0026] Figure 4 A schematic diagram of the structure of a domain name classification system provided in an embodiment of the present application.

[0027] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0028] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0029] In order to clearly understand the technical solution of the present application, the solution of the prior art is first introduced in detail. The content distribution network CDN distributes the source site content to acceleration nodes all over the world. When a user initiates a website resource request to the source domain website through the source domain name, the request will be dispatched to the node closest to the user, thereby improving the user's network access speed. For content providers, their source domain names belong to the assets of the content provider, but the CNAME domain names used to achieve content distribution are controlled and resolved by the CDN provider and do not belong to the assets of the content provider. Therefore, when performing asset mapping, it is necessary to distinguish between domain names belonging to content providers and CDN domain names belonging to CDN providers. Traditional CDN domain name classification generally extracts statistical features related to the domain name for detection. In the actual implementation process, due to the complexity of the existing network, the statistical-based features may be offset and have a negative impact on the classification effect.

[0030] In response to the above technical problems, the inventors first thought of building a resolution graph based on DNS data to describe the association between different types of domain names and IP addresses during domain name resolution, extracting detection features and text features based on the resolution graph and the text content of the CNAME record, and finally using a pre-trained classifier to classify the domain name and output the CDN domain name classification results. Feature extraction based on the association relationship reflected in the resolution graph avoids the data offset that may be introduced by simple statistical features and improves the robustness of domain name classification.

[0031] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0032] Figure 1 A schematic diagram of a scenario of a CDN domain name classification processing method provided in an embodiment of the present application, such as Figure 1 As shown, the specific application scenarios of the present application include: a network access device 101 and a domain name classification system 102.

[0033] The network access device 101 may be a recursive resolver or a gateway.

[0034] Specifically, the network access device 101 sends the DNS resolution data to the domain name classification system 102, and the domain name classification system 102 constructs a resolution graph based on the DNS resolution data, wherein the resolution graph includes user domain name nodes, CNAME domain name nodes, CNAME secondary domain name nodes, and IP address nodes, as well as edges corresponding to the association relationship between each node; based on the association relationship between each CNAME domain name and the user domain name, the association relationship between each CNAME domain name and each CNAME secondary domain name, and the association relationship between the user domain name and the IP address, the detection features of each CNAME domain name are extracted, and based on each CNAME domain name, the text features of each CNAME domain name are extracted; the detection features and text features of each CNAME domain name are input into a pre-trained classifier to obtain a CDN domain name classification result.

[0035] Figure 2 A flow chart of the CDN domain name classification processing method provided for this application is as follows: Figure 2 As shown, the method includes S201-S206:

[0036] S201: Receive Domain Name System DNS resolution data sent by a network access device.

[0037] Specifically, DNS resolution data is collected from the recursive resolver or gateway, including but not limited to DNS resolution logs, DNS resolution traffic, etc.

[0038] S202: Construct a resolution graph according to the DNS resolution data, wherein the nodes of the resolution graph include user domain names, canonical name CNAME domain names, CNAME secondary domain names and Internet Protocol IP addresses.

[0039] The resolution graph includes four types of nodes. The first type of node is the domain name resolved by the client, called the user domain name. The second type of node is the CNAME record of the user domain name, called the CNAME domain name. The third type of node is the IP address list obtained by resolving the user domain name. The IP addresses in the IP address list are called IP addresses. The fourth type of node is the secondary domain name of the CNAME record, called the CNAME secondary domain name.

[0040] Specifically, the construction process of the DNS resolution graph includes Sa01~Sa10:

[0041] Sa01: In the DNS resolution data, obtain the user domain name obtained by the client resolving the domain name as the user domain name node.

[0042] Specifically, the domain name directly entered by the user in the browser address bar is obtained as the user domain name node.

[0043] For example, if a user wants to visit a website, he or she enters the domain name in the browser. This domain name is the original domain name from which the client initiates the resolution request.

[0044] Sa02: According to the user domain name, the corresponding CNAME record is queried in the network access device to obtain the CNAME domain name as the CNAME domain name node.

[0045] Specifically, when the client initiates a DNS query for the original domain name, the DNS server will check the DNS record of the domain name. If the domain name has a CNAME record set, the corresponding CNAME domain name will be found according to the CNAME record during the DNS query process. All CNAME domain names are obtained as CNAME domain name nodes.

[0046] Sa03: Based on the IP address list obtained by the network access device after resolving the user's domain name, each IP address is determined as an IP address node.

[0047] Specifically, if the domain name does not have a CNAME record or the final domain name after CNAME resolution has a record pointing to an IP address, the DNS server will obtain the IP address by querying the record pointing to the IP address, obtain a list of all IP addresses, and use all the IPs therein as IP address nodes.

[0048] Sa04: The CNAME second-level domain name obtained according to the second-level domain name corresponding to the CNAME domain name is used as the CNAME second-level domain name node.

[0049] Specifically, in the DNS configuration management interface of the domain name or the DNS record file, when viewing the CNAME record, you can clearly see the complete form of the CNAME domain name, and then determine the second-level domain name according to the rules of the domain name hierarchy, and use the obtained CNAME second-level domain name as the CNAME second-level domain name node.

[0050] Sa05: The user domain name node, the CNAME domain name node, the IP address node and the CNAME secondary domain name node are determined as a node set.

[0051] Sa06: Create an edge between the user domain name node and the CNAME domain name node corresponding to the user domain name.

[0052] Specifically, an edge is established between the user domain name node and the CNAME domain name node corresponding to the user domain name. This edge reflects the direct association between the user domain name and the CNAME domain name it points to. In the actual domain name resolution process, when querying the user domain name, it may first encounter the situation that it points to another domain name through the CNAME record. This edge accurately captures this initial pointing relationship.

[0053] Sa07: Create an edge between the user domain name node and the IP address node corresponding to the user domain name.

[0054] Specifically, an edge is established between the user domain name node and the IP address node corresponding to the user domain name. By establishing this edge, the mapping relationship from the user domain name to the IP address that can ultimately be used for communication is displayed.

[0055] Sa08: Create an edge between the CNAME domain name node and the CNAME secondary domain name node corresponding to the CNAME domain name.

[0056] Specifically, an edge is established between a CNAME domain name node and a CNAME secondary domain name node corresponding to the CNAME domain name. This edge reflects the nested relationship of placing a CNAME domain name pointing to the secondary domain name of the CNAME domain name.

[0057] Sa09: Determine all established edges as an edge set.

[0058] Sa10: Construct a parsing graph based on a set of nodes and a set of edges.

[0059] Specifically, a parsing graph is constructed based on a node set and an edge set, with each node in the node set as a vertex and each edge in the edge set as a connecting line segment.

[0060] S203: In the parsing graph, based on the association relationship between each CNAME domain name and the user domain name, the association relationship between each CNAME domain name and the CNAME secondary domain name, and the association relationship between the user domain name and the IP address, the detection features of each CNAME domain name are extracted.

[0061] Among them, the detection features include a first feature, a second feature, a third feature, a fourth feature, a fifth feature and a sixth feature.

[0062] Among them, the first feature is the number of nodes in the connected subgraph of the CNAME domain name node; the second feature is the number of all CNAME domain name nodes associated with the second-level domain name of the CNAME domain name node; the third feature is the number of all user domain name nodes associated with the second-level domain name of the CNAME domain name node; the fourth feature is the number of all IP address nodes associated with the second-level domain name of the CNAME domain name node; the fifth feature is the number of all user domain name nodes associated with the CNAME domain name node; the sixth feature is the number of second-level domain names of all user domain names associated with the CNAME domain name node.

[0063] Specifically, the steps of extracting the detection features of each CNAME domain name include Sb01 to Sb09:

[0064] Sb01: In the parsing graph, determine the minimum connected subgraph of each CNAME based on the edges and nodes connected to each CNAME domain name node.

[0065] The parsing graph is divided into several connected subgraphs, and the connected subgraph is the smallest connected subgraph that contains the CNAME domain name node.

[0066] Sb02: Obtain the number of nodes in the minimum connected subgraph of each CNAME domain name node to determine the first feature.

[0067] Sb03: Acquire all CNAME secondary domain name nodes connected to each CNAME domain name node to obtain a CNAME secondary domain name set.

[0068] Specifically, a set consisting of CNAME secondary domain names connected to each CNAME domain name node is determined as a CNAME secondary domain name set.

[0069] Sb04: Obtain the number of all CNAME domain name nodes connected to all CNAME second-level domain name nodes in the CNAME second-level domain name set to determine the second feature.

[0070] Specifically, in the CNAME secondary domain name set, the set of CNAME domain name nodes in the neighboring nodes of each CNAME secondary domain name node is recorded as N_S 1st , N_S 1st The number of nodes in the set is determined as the second feature.

[0071] Sb05: Determine a CNAME domain name set based on all CNAME domain name nodes, and obtain the number of all user domain name nodes connected to all CNAME domain name nodes in the CNAME domain name set to determine the third feature.

[0072] Specifically, for N_S 1st All CNAME domain name nodes in the set, the set consisting of user domain name nodes in the neighboring nodes of all CNAME domain name nodes is recorded as N_S 2nd , N_S 2nd The number of nodes in the set is determined as the third feature.

[0073] Sb06: Determine a user domain name set based on all user domain name nodes, and obtain the number of all IP address nodes connected to all user domain name nodes in the user domain name set, which is determined as the fourth feature.

[0074] Specifically, for N_S 2nd All user domain name nodes in the set, the set consisting of IP address nodes in the neighboring nodes of all user domain name nodes is recorded as N_S 3rd , N_S3rd The number of nodes in the set is determined as the fourth feature.

[0075] Sb07: Obtain the number of all user domain name nodes connected to each CNAME domain name node, and determine the fifth feature.

[0076] Specifically, the set of user domain name nodes in the neighboring nodes of each CNAME domain name node is recorded as N_C 1st , N_C 1st The number of nodes in the set is determined as the fifth feature.

[0077] Sb08: Obtain the number of second-level domain names of all user domain names connected to each CNAME domain name node, and determine the sixth feature.

[0078] Specifically, for N_C 1st The set of all user domain names in the set and the second-level domain names of all user domain names is recorded as SLD_C 1st , SLD_C 1st The number of nodes in the set is determined as the sixth feature.

[0079] Sb09: Determine the first feature, the second feature, the third feature, the fourth feature, the fifth feature and the sixth feature as detection features of each CNAME domain name.

[0080] S204: Extracting text features of each CNAME domain name according to each CNAME domain name.

[0081] The text features of each CNAME domain name include a seventh feature, an eighth feature, a ninth feature, a tenth feature, an eleventh feature and a twelfth feature.

[0082] Among them, the seventh feature is the length of the CNAME domain name, the eighth feature is the number of '.' in the CNAME domain name, the ninth feature is the number of underscores in the CNAME domain name, the tenth feature is the number of numbers in the CNAME domain name, the eleventh feature is the proportion of user domain names associated with the CNAME domain name that share a similar suffix with the CNAME domain name, and the twelfth feature is the prefix similarity between the CNAME domain name and the user domain names associated with it.

[0083] Specifically, the steps of extracting text features of each CNAME domain name include Sc01 to Sc08:

[0084] Sc01: Obtain the string length of each CNAME domain name and determine it as the seventh feature.

[0085] Specifically, the character string length of each CNAME domain name is determined as the seventh feature.

[0086] Sc02: Obtain the number of dots in each CNAME domain name and determine it as the eighth feature.

[0087] Specifically, the number of '.' in each CNAME domain name is determined as the eighth feature.

[0088] Sc03: Obtain the number of underscores in each CNAME domain name and determine it as the ninth feature.

[0089] Specifically, the number of underscores in each CNAME domain name is determined as the ninth feature.

[0090] Sc04: Obtain the number of digits in each CNAME domain name and determine it as the tenth feature.

[0091] Specifically, the number of digits in each CNAME domain name is determined as the tenth feature.

[0092] Sc05: Obtain the second-level domain names of all user domain names connected to each CNAME domain name node, and determine the number of nodes whose second-level domain names are the same as the second-level domain names of each CNAME domain name.

[0093] Sc06: Determine the eleventh feature based on the ratio of the number of nodes to the fifth feature.

[0094] Specifically, the second label of the CNAME domain name is recorded as label_2, N_C 1st The number of nodes whose second label is not label_2 for all user domain names in the set is L. The calculation formula for the eleventh feature is: F 11 =L / F5, where F 11 is the eleventh feature and F5 is the fifth feature.

[0095] Sc07: Determine the twelfth feature according to the prefix of each CNAME domain name and all user domain names connected to each CNAME domain name node.

[0096] Specifically, the step of determining the twelfth feature includes Sd01~Sd02:

[0097] Sd01: If the prefix of each CNAME domain name is the same as the prefix of any user domain name among all user domain names connected to each CNAME domain name node, the twelfth feature is determined to be 1.

[0098] Sd02: If the prefix of each CNAME domain name is different from the prefixes of all user domain names connected to each CNAME domain name node, the twelfth feature is determined to be 0.

[0099] Specifically, if the prefix of the CNAME domain name is N_C 1st If the prefixes of any user domain names in the set are the same, the twelfth feature is 1, otherwise the twelfth feature is 0.

[0100] Sc08: Determine the seventh feature, the eighth feature, the ninth feature, the tenth feature, the eleventh feature and the twelfth feature as text features of each CNAME domain name.

[0101] S205: Obtaining an unmarked feature set of each CNAME domain name according to the detection feature and the text feature.

[0102] Specifically, the detection features and text features of each CNAME domain name are summarized to obtain the unmarked features of each CNAME domain name.

[0103] S206: Input the unlabeled feature sets of all CNAME domain names into a pre-trained classifier to output a content delivery network CDN domain name classification result.

[0104] Specifically, after the unlabeled features of the CNAME domain name are input into the pre-trained classifier, the final output is a binary judgment result of whether the CNAME domain name belongs to the CDN domain name.

[0105] In summary, we can build a resolution graph based on DNS data to describe the association between different types of domain names and IP addresses during domain name resolution. We extract detection features and text features based on the resolution graph and the text content of the CNAME record. Finally, we use a pre-trained classifier to classify the domain name and output the CDN domain name classification results. Feature extraction based on the association reflected in the resolution graph avoids the data offset that may be introduced by simple statistical features and improves the robustness of domain name classification.

[0106] In another embodiment of the present application, the training process of the classifier used includes the following steps:

[0107] S301: construct an initial CDN domain name suffix library, wherein the initial CDN domain name suffix library is empty.

[0108] Specifically, an initially empty CDN domain name suffix library is created. The main function of the CDN domain name suffix library is to store domain name suffix information related to CDN in the future.

[0109] S302: Collect CDN domain name suffix data based on preset rules, and store the CDN domain name suffix data in a CDN domain name suffix library.

[0110] Specifically, CDN domain name suffix data is collected according to pre-set rules. These pre-set rules may involve obtaining relevant information from specific data sources, such as domain name examples published on the official website of a known CDN service provider, common CDN domain name formats mentioned in network industry reports, etc., or screening out possible CDN domain name suffixes based on some rules summarized from previous observations and analyses of CDN domain names. The collected CDN domain name suffix data is stored in the previously constructed CDN domain name suffix library.

[0111] S303: Match the DNS resolution log sent by the network access device according to the CDN domain name suffix library to obtain a preliminarily identified CDN domain name.

[0112] Specifically, a matching operation is performed on the DNS resolution log sent by the network access device. By comparing the domain names in the DNS resolution log with the suffix information in the CDN domain name suffix library one by one, entries that may be CND domain names can be preliminarily screened out, thereby obtaining a preliminarily identified CDN domain name.

[0113] S304: Extract detection features and text features of the preliminarily identified CDN domain name.

[0114] Specifically, for the initially identified CDN domain names, their detection features and text features are further extracted.

[0115] S305: Input the detection features and text features of the initially identified CDN domain name into the initial PU-learning classifier to train the PU-learning classifier.

[0116] Specifically, the detection features and text features of the initially identified CDN domain name are input into the initial PU-learning classifier. The PU-learning classifier is a special classifier that is suitable for handling classification problems with imbalanced positive and negative samples. In this scenario, by inputting these features, the classifier learns the differences between CDN domain names and non-CDN domain names and their respective feature patterns, thereby continuously adjusting its own classification parameters, achieving effective training of the classifier, and enabling it to more accurately identify CDN domain names in subsequent classification tasks.

[0117] S306: Use the PU-learning classifier to classify the multiple domain names to output a detection result.

[0118] S307: For the domain name marked as a CDN domain name in the detection result, an active request is sent to the DNS server to determine whether the domain name uses CDN.

[0119] Specifically, for the domain name marked as a CDN domain name in the detection result, an active request is sent to the DNS server.

[0120] S308: If the domain name uses CDN, the suffix information of the domain name is updated to the CDN domain name suffix library, wherein the CDN domain name suffix library is used to iteratively train the PU-learning classifier to obtain a pre-trained classifier.

[0121] Specifically, if the domain name does use CDN, the suffix information of the domain name is updated to the CDN domain name suffix library. The updated CDN domain name suffix library is used to iteratively train the PU-learning classifier. With the continuous updating and improvement of the CDN domain name suffix library, the classifier can learn more new features and patterns in each iterative training, thereby continuously improving its classification ability. After multiple iterative trainings, a pre-trained classifier is finally obtained.

[0122] In summary, by gradually building and improving the CDN domain name suffix library, a pre-trained classifier with high accuracy is trained, which provides support for accurate identification of CDN domain names and classification processing.

[0123] Figure 3 A schematic diagram of the structure of a CDN domain name classification processing device provided in an embodiment of the present application, such as Figure 3 As shown, the device includes: a data receiving module 301, a parsing graph building module 302, a detection feature extraction module 303, a text feature extraction module 304, an unlabeled feature set determination module 305 and a classification result output module 306.

[0124] The data receiving module 301 is used to receive the domain name system DNS resolution data sent by the network access device.

[0125] The resolution graph construction module 302 is used to construct a resolution graph according to the DNS resolution data, wherein the nodes of the resolution graph include user domain names, canonical name CNAME domain names, CNAME secondary domain names and Internet Protocol IP addresses.

[0126] The detection feature extraction module 303 is used to extract the detection features of each CNAME domain name in the parsing graph according to the association relationship between each CNAME domain name and the user domain name, the association relationship between each CNAME domain name and the CNAME secondary domain name, and the association relationship between the user domain name and the IP address.

[0127] The text feature extraction module 304 is used to extract the text features of each CNAME domain name according to each CNAME domain name.

[0128] The unmarked feature set determination module 305 is used to obtain the unmarked feature set of each CNAME domain name according to the detection feature and the text feature.

[0129] The classification result output module 306 is used to input the unlabeled feature set of all CNAME domain names into the pre-trained classifier to output the content delivery network CDN domain name classification result.

[0130] In one possible implementation, the resolution graph construction module 302 is specifically used to obtain, in the DNS resolution data, a user domain name obtained by the client when resolving the domain name, as a user domain name node; based on the user domain name, query the corresponding CNAME record in the network access device to obtain a CNAME domain name, as a CNAME domain name node; determine each IP address based on the IP address list obtained by the network access device when resolving the user domain name, as an IP address node; use the CNAME second-level domain name obtained based on the second-level domain name corresponding to the CNAME domain name as a CNAME second-level domain name node; determine the user domain name node, CNAME domain name node, IP address node and CNAME second-level domain name node as a node set; establish an edge between the user domain name node and the CNAME domain name node corresponding to the user domain name; establish an edge between the user domain name node and the IP address node corresponding to the user domain name; establish an edge between the CNAME domain name node and the CNAME second-level domain name node corresponding to the CNAME domain name; determine all established edges as an edge set; and construct a resolution graph based on the node set and the edge set.

[0131] In a possible implementation, the detection feature extraction module 303 is specifically used to determine the minimum connected subgraph of each CNAME in the parsing graph based on the edges and nodes connected to each CNAME domain name node; obtain the number of nodes in the minimum connected subgraph of each CNAME domain name node to determine the first feature; obtain all CNAME second-level domain name nodes connected to each CNAME domain name node to obtain a CNAME second-level domain name set; obtain the number of all CNAME domain name nodes connected to all CNAME second-level domain name nodes in the CNAME second-level domain name set to determine the second feature; determine the CNAME domain name set based on all CNAME domain name nodes, and The number of all user domain name nodes connected to all CNAME domain name nodes is obtained in the CNAME domain name set to determine the third feature; based on all user domain name nodes, a user domain name set is determined, and the number of all IP address nodes connected to all user domain name nodes is obtained in the user domain name set to determine the fourth feature; the number of all user domain name nodes connected to each CNAME domain name node is obtained to determine the fifth feature; the number of second-level domain names of all user domain names connected to each CNAME domain name node is obtained to determine the sixth feature; the first feature, the second feature, the third feature, the fourth feature, the fifth feature and the sixth feature are determined as the detection features of each CNAME domain name.

[0132] In one possible implementation, the text feature extraction module 304 is specifically used to obtain the string length of each CNAME domain name, which is determined as the seventh feature; obtain the number of dots in each CNAME domain name, which is determined as the eighth feature; obtain the number of underscores in each CNAME domain name, which is determined as the ninth feature; obtain the number of numbers in each CNAME domain name, which is determined as the tenth feature; obtain the second-level domain names of all user domain names connected to each CNAME domain name node, and determine the number of nodes whose second-level domain names are the same as the second-level domain names of each CNAME domain name; determine the eleventh feature based on the ratio of the number of nodes to the fifth feature; determine the twelfth feature based on the prefix of each CNAME domain name and all user domain names connected to each CNAME domain name node; and determine the seventh feature, the eighth feature, the ninth feature, the tenth feature, the eleventh feature, and the twelfth feature as the text features of each CNAME domain name.

[0133] In one possible implementation, the text feature extraction module 304 is further specifically used to determine that the twelfth feature is 1 if the prefix of each CNAME domain name is the same as the prefix of any user domain name in all user domain names connected to each CNAME domain name node; if the prefix of each CNAME domain name is different from the prefix of all user domain names connected to each CNAME domain name node, then the twelfth feature is determined to be 0.

[0134] In a possible implementation, the device also includes a classifier training module, which is specifically used to construct an initial CDN domain name suffix library, wherein the initial CDN domain name suffix library is empty; CDN domain name suffix data is collected based on preset rules, and the CDN domain name suffix data is stored in the CDN domain name suffix library; the DNS resolution log sent by the network access device is matched according to the CDN domain name suffix library to obtain a preliminarily identified CDN domain name; the detection features and text features of the preliminarily identified CDN domain name are extracted; the detection features and text features of the preliminarily identified CDN domain name are input into the initial PU-learning classifier to train the PU-learning classifier; multiple domain names are classified using the PU-learning classifier to output a detection result; for the domain name marked as a CDN domain name in the detection result, an active request is sent to the DNS server to determine whether the domain name uses CDN; if the domain name uses CDN, the suffix information of the domain name is updated to the CDN domain name suffix library, wherein the CDN domain name suffix library is used to iteratively train the PU-learning classifier to obtain a pre-trained classifier.

[0135] The CDN domain name classification processing device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and this embodiment will not be described in detail here.

[0136] Figure 4 This is a schematic diagram of the structure of the domain name classification system provided in the embodiment of the present application. Figure 4 As shown, the domain name classification system provided in this embodiment includes: at least one processor 401 and a memory 402. Optionally, the domain name classification system also includes a communication component 403. The processor 401, the memory 402 and the communication component 403 are connected via a bus 404.

[0137] In a specific implementation process, at least one processor 401 executes the computer-executable instructions stored in the memory 402, so that at least one processor 401 executes the above method.

[0138] The specific implementation process of the processor 401 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0139] In the above embodiments, it should be understood that the processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the invention can be directly implemented as a hardware processor, or can be implemented by a combination of hardware and software modules in the processor.

[0140] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (NVM), such as at least one disk storage.

[0141] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of this application is not limited to only one bus or one type of bus.

[0142] An embodiment of the present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0143] An embodiment of the present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0144] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0145] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0146] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0147] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0148] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0149] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0150] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0151] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A CDN domain name classification processing method, characterized in that: Applied to domain name classification systems, including: Receive DNS resolution data sent by network access devices; Constructing a resolution graph according to the DNS resolution data, wherein the nodes of the resolution graph include user domain names, canonical name CNAME domain names, CNAME secondary domain names, and Internet Protocol IP addresses; In the analysis graph, according to the association relationship between each CNAME domain name and the user domain name, the association relationship between each CNAME domain name and the CNAME secondary domain name, and the association relationship between the user domain name and the IP address, the detection features of each CNAME domain name are extracted; Extracting text features of each CNAME domain name according to each CNAME domain name; Obtaining a tag-free feature set of each CNAME domain name according to the detection feature and the text feature; The unlabeled feature set of all CNAME domain names is input into the pre-trained classifier to output the content delivery network CDN domain name classification result.

2. The method according to claim 1, characterized in that The construction process of the analysis graph includes: In the DNS resolution data, the user domain name obtained by the client through domain name resolution is obtained as a user domain name node; According to the user domain name, query the corresponding CNAME record in the network access device to obtain the CNAME domain name as the CNAME domain name node; According to the IP address list obtained by the network access device through resolving the user domain name, each IP address is determined as an IP address node; Using the CNAME secondary domain name obtained according to the secondary domain name corresponding to the CNAME domain name as the CNAME secondary domain name node; Determine the user domain name node, the CNAME domain name node, the IP address node and the CNAME secondary domain name node as a node set; Establishing an edge between the user domain name node and the CNAME domain name node corresponding to the user domain name; Establishing an edge between the user domain name node and the IP address node corresponding to the user domain name; Establishing an edge between the CNAME domain name node and the CNAME secondary domain name node corresponding to the CNAME domain name; All established edges are determined as edge sets; The parsing graph is constructed according to the node set and the edge set.

3. The method according to claim 2, characterized in that The detection features include a first feature, a second feature, a third feature, a fourth feature, a fifth feature and a sixth feature; Accordingly, the extracting the detection features of each CNAME domain name includes: In the parsing graph, determining the minimum connected subgraph of each CNAME according to the edges and nodes connected to each CNAME domain name node; Obtaining the number of nodes in the minimum connected subgraph of each CNAME domain name node to determine the first feature; Obtain all CNAME secondary domain name nodes connected to each CNAME domain name node to obtain a CNAME secondary domain name set; Obtaining the number of all CNAME domain name nodes connected to all CNAME second-level domain name nodes in the CNAME second-level domain name set, and determining the second feature; Determine a CNAME domain name set according to all the CNAME domain name nodes, and obtain the number of all user domain name nodes connected to all the CNAME domain name nodes in the CNAME domain name set to determine the third feature; Determine a user domain name set according to all the user domain name nodes, and obtain the number of all IP address nodes connected to all the user domain name nodes in the user domain name set, and determine it as the fourth feature; Obtaining the number of all user domain name nodes connected to each CNAME domain name node to determine the fifth feature; Obtaining the number of second-level domain names of all user domain names connected to each CNAME domain name node to determine the sixth feature; The first feature, the second feature, the third feature, the fourth feature, the fifth feature and the sixth feature are determined as detection features of each CNAME domain name.

4. The method according to claim 3, characterized in that The text features include a seventh feature, an eighth feature, a ninth feature, a tenth feature, an eleventh feature and a twelfth feature; Accordingly, the extracting text features of each CNAME domain name includes: Obtaining the character string length of each CNAME domain name, and determining it as the seventh feature; Obtaining the number of dots in each CNAME domain name and determining it as the eighth feature; Obtaining the number of underscores in each CNAME domain name, and determining it as the ninth feature; Obtaining the number of digits in each CNAME domain name and determining it as the tenth feature; Obtaining the second-level domain names of all user domain names connected to the CNAME domain name nodes, and determining the number of nodes where the second-level domain names are identical to the second-level domain names of the CNAME domain names; Determining the eleventh feature according to the ratio of the number of nodes to the fifth feature; Determining the twelfth feature according to the prefixes of the CNAME domain names and all user domain names connected to the CNAME domain name nodes; The seventh feature, the eighth feature, the ninth feature, the tenth feature, the eleventh feature and the twelfth feature are determined as text features of the respective CNAME domain names.

5. The method according to claim 4, characterized in that The determining the twelfth feature comprises: If the prefix of each CNAME domain name is the same as the prefix of any user domain name among all user domain names connected to each CNAME domain name node, then the twelfth feature is determined to be 1; If the prefixes of the CNAME domain names are different from the prefixes of all user domain names connected to the CNAME domain name nodes, the twelfth feature is determined to be 0.

6. The method according to claim 1, characterized in that The training process of the classifier includes: Building an initial CDN domain name suffix library, wherein the initial CDN domain name suffix library is empty; Collect CDN domain name suffix data based on preset rules, and store the CDN domain name suffix data in the CDN domain name suffix library; Matching the DNS resolution log sent by the network access device according to the CDN domain name suffix library to obtain a preliminarily identified CDN domain name; Extracting detection features and text features of the initially identified CDN domain name; Inputting the detection features and text features of the initially identified CDN domain name into an initial PU-learning classifier to train the PU-learning classifier; Using the PU-learning classifier to classify multiple domain names to output detection results; For the domain name marked as a CDN domain name in the detection result, an active request is sent to the DNS server to determine whether the domain name uses the CDN; If the domain name uses CDN, the suffix information of the domain name is updated to the CDN domain name suffix library, wherein the CDN domain name suffix library is used to iteratively train the PU-learning classifier to obtain a pre-trained classifier.

7. A CDN domain name classification processing device, characterized in that: Applied to domain name classification systems, including: A data receiving module, used for receiving the DNS resolution data sent by the network access device; A resolution graph construction module, used to construct a resolution graph according to the DNS resolution data, wherein the nodes of the resolution graph include user domain names, canonical name CNAME domain names, CNAME secondary domain names and Internet Protocol IP addresses; A detection feature extraction module, configured to extract detection features of each CNAME domain name in the analysis graph according to an association relationship between each CNAME domain name and the user domain name, an association relationship between each CNAME domain name and the CNAME secondary domain name, and an association relationship between the user domain name and the IP address; A text feature extraction module, used to extract text features of each CNAME domain name according to each CNAME domain name; An unmarked feature set determination module, used to obtain an unmarked feature set of each CNAME domain name according to the detection feature and the text feature; The classification result output module is used to input the unlabeled feature set of all CNAME domain names into the pre-trained classifier to output the content distribution network CDN domain name classification result.

8. A domain name classification system, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 6 when executed by a processor.

10. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 6 when being executed by a processor.

Images