Analysis method for checking illegal content distribution based on multiple information bases and related equipment

Abstract

The invention discloses an analysis method for checking illegal content distribution based on multiple information bases and related equipment, and relates to the technical field of network security, the analysis method for checking illegal content distribution based on multiple information bases comprises the following steps: firstly, acquiring IP address information with abnormal traffic, the IP address information with abnormal traffic comprising IP filing information; secondly, acquiring domain name information corresponding to the IP address with abnormal flow; thirdly, carrying out certificate chain analysis on the IP address information with the abnormal flow to obtain certificate information; and finally, determining whether illegal content distribution exists or not based on the IP filing information, the certificate information and the domain name information. According to the embodiment of the invention, firstly, starting from the IP address information with the abnormal flow, the investigation range can be narrowed, further, the IP filing information, the domain name information and the certificate information of the IP address information with the abnormal flow are obtained, and whether illegal content distribution exists or not is determined by combining the three key information, namely the IP filing information and the certificate information with the domain name information. The detection accuracy of illegal content distribution behaviors can be improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an analysis method and related equipment for checking the distribution of illegal content based on multiple information bases. Background Art

[0002] With the rapid development of the Internet, the application of content delivery network (CDN) technology in content distribution is becoming more and more widespread. CDN is a distributed server system that can improve the transmission speed and availability of Internet content by deploying servers in multiple geographical locations. CDN caches content on edge servers close to users, reducing the distance between users and source servers, thereby speeding up the loading of content. However, there are still unauthorized content distribution behaviors using CDN in Internet applications, resulting in resource abuse and network security risks.

[0003] Related technologies mainly screen illegal content distribution behaviors by monitoring CDN traffic, but this method has the problem of insufficient detection accuracy. Summary of the invention

[0004] The main purpose of the embodiments of the present application is to provide an analysis method and related equipment for checking the distribution of illegal content based on multiple information bases, aiming to improve the detection accuracy of illegal content distribution behavior.

[0005] To achieve the above purpose, one aspect of an embodiment of the present application proposes an analysis method for checking the distribution of illegal content based on multiple information libraries, comprising the following steps:

[0006] Obtaining IP address information of abnormal traffic, wherein the IP address information of abnormal traffic includes IP filing information;

[0007] Obtaining the domain name information corresponding to the IP address with abnormal traffic;

[0008] Performing certificate chain analysis on the IP address information of the traffic anomaly to obtain certificate information;

[0009] Determine whether there is illegal content distribution based on the IP registration information, the certificate information and the domain name information.

[0010] In some embodiments, the domain name information includes domain name attribution information and canonical name attribution information, and obtaining the domain name information corresponding to the IP address with abnormal traffic includes:

[0011] Determine the domain name attribution information and the canonical name attribution information corresponding to the IP address with abnormal traffic through a domain name gene library, wherein the domain name gene library is used to represent a global domain name information database including IP address information and domain name registration information;

[0012] The determining whether there is illegal content distribution based on the IP filing information, the certificate information and the domain name information includes:

[0013] Determine whether there is illegal content distribution based on the IP filing information, the certificate information, the domain name ownership information and the standard name ownership information.

[0014] In some embodiments, before obtaining the IP address information of the traffic anomaly, the method further includes:

[0015] Get network traffic data;

[0016] Performing offline statistical analysis on the network traffic data over a preset time period to obtain analysis results;

[0017] The IP address information of the traffic anomaly is determined based on the analysis result.

[0018] In some embodiments, before obtaining the IP address information of the traffic anomaly, the method further includes:

[0019] Get domain name system log data;

[0020] Based on the domain name system log data, a domain name and IP address information corresponding to the domain name are determined.

[0021] In some embodiments, the certificate information includes certificate user information, and the performing of certificate chain parsing on the IP address information of the traffic anomaly to obtain the certificate information includes:

[0022] Performing certificate chain analysis on the IP address information of the abnormal traffic to obtain the certificate user information;

[0023] The determining whether there is illegal content distribution based on the IP filing information, the certificate information and the domain name information includes:

[0024] Determine whether there is illegal content distribution based on the IP registration information, the certificate user information and the domain name information.

[0025] In some embodiments, the IP filing information includes an IP filing unit, the domain name information includes domain name ownership information and canonical name ownership information, the certificate information includes certificate user information, and determining whether there is illegal content distribution based on the IP filing information, the certificate information and the domain name information includes:

[0026] Determine whether there is illegal content distribution based on the IP filing unit, the domain name ownership information, the standard name ownership information and the certificate user information.

[0027] In some embodiments, the determining whether there is illegal content distribution based on the IP filing unit, the domain name ownership information, the standard name ownership information and the certificate user information includes:

[0028] If there is one or more inconsistent information among the IP filing unit, the domain name ownership information, the standard name ownership information and the certificate user information, a compliance assessment is performed on the inconsistent information to obtain an assessment result;

[0029] Determine whether there is illegal content distribution based on the evaluation result.

[0030] In some embodiments, the evaluation result includes a violation evaluation result, and the compliance evaluation of the inconsistent information to obtain the evaluation result includes:

[0031] Obtaining content distribution network qualification indication information and content distribution network resource sublease indication information;

[0032] If the content distribution network qualification indication information indicates that the inconsistent information does not have the content distribution network qualification or the content distribution network resource sublease indication information indicates that the inconsistent information is a resource sublease, the violation assessment result is output.

[0033] In some embodiments, after determining whether there is illegal content distribution based on the IP filing information, the certificate information and the domain name information, the method further includes:

[0034] The IP filing information, the certificate information, the domain name information and the information on whether there is illegal content distribution are stored and / or a visual analysis report is generated.

[0035] To achieve the above-mentioned purpose, another aspect of the embodiment of the present application proposes an analysis device for checking illegal content distribution behavior based on multiple information bases, the device comprising:

[0036] A first acquisition module is used to acquire IP address information of abnormal traffic flow, wherein the IP address information of abnormal traffic flow includes IP filing information;

[0037] A second acquisition module is used to obtain the domain name information corresponding to the IP address with abnormal traffic;

[0038] A certificate chain parsing module is used to perform certificate chain parsing on the IP address information of the traffic anomaly to obtain certificate information;

[0039] The violation analysis module is used to determine whether there is any illegal content distribution based on the IP registration information, the certificate information and the domain name information.

[0040] To achieve the above-mentioned purpose, another aspect of an embodiment of the present application proposes an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the above-mentioned analysis method for checking the distribution of illegal content based on multiple information libraries is implemented.

[0041] To achieve the above-mentioned purpose, another aspect of an embodiment of the present application proposes a computer program product, which includes a computer program code. When the computer program code runs on a computer, the computer executes the above-mentioned analysis method for checking the distribution of illegal content based on multiple information libraries.

[0042] The embodiments of the present application include at least the following beneficial effects:

[0043] The present application provides an analysis method and related equipment for checking illegal content distribution based on multiple information bases. In an embodiment of the present application, first, obtain the IP address information of abnormal traffic flow, and the IP address information of abnormal traffic flow includes IP filing information; secondly, obtain the domain name information corresponding to the IP address of abnormal traffic flow; thirdly, perform certificate chain parsing on the IP address information of abnormal traffic flow to obtain certificate information; finally, determine whether there is illegal content distribution based on the IP filing information, certificate information and domain name information. The embodiment of the present application first starts with the IP address information of abnormal traffic flow, which can narrow the scope of investigation, and further obtains the IP filing information, domain name information and certificate information of the IP address information of abnormal traffic flow. The three key information of IP filing information, certificate information and domain name information are combined to determine whether there is illegal content distribution, which can improve the detection accuracy of illegal content distribution behavior.

[0044] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0046] Figure 1 It is a flow chart of an analysis method for checking illegal content distribution based on multiple information bases provided by some embodiments of the present application;

[0047] Figure 2 is another flow chart of an analysis method for checking illegal content distribution based on multiple information bases provided by some embodiments of the present application;

[0048] Figure 3 is a flow chart of a method for determining IP address information of abnormal traffic provided by some embodiments of the present application;

[0049] Figure 4 is a flowchart of a method for determining domain name information provided by some embodiments of the present application;

[0050] Figure 5 It is another flow chart of an analysis method for checking illegal content distribution based on multiple information bases provided by some embodiments of the present application;

[0051] Figure 6 yes Figure 1 Flowchart of step 104 in;

[0052] Figure 7 yes Figure 1 Another flow chart of step 104 in;

[0053] Figure 8 is a data collection and storage flow chart provided by some embodiments of the present application;

[0054] Fig. 9 is a data collection and analysis flow chart provided by some embodiments of the present application;

[0055] Fig.10 It is another flow chart of an analysis method for checking illegal content distribution based on multiple information bases provided by some embodiments of the present application;

[0056] Fig.11 It is a schematic block diagram of modules of an analysis device for checking illegal content distribution behavior based on multiple information bases provided by some embodiments of the present application;

[0057] Fig.12 It is a schematic diagram of the hardware structure of an electronic device provided in some embodiments of the present application. DETAILED DESCRIPTION

[0058] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the reference to "embodiment" in this article means that the specific features, structures or characteristics described in conjunction with the embodiment may be included in at least one embodiment of the present application. The appearance of this phrase in various positions in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the embodiments of the present application. They are only examples of devices and methods consistent with some aspects of the embodiments of the present application as detailed in the attached claims.

[0059] It is understood that the terms "first", "second", etc. used in this application can be used to describe various concepts in this article, but unless otherwise specified, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another concept. For example, without departing from the scope of the embodiment of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the words "if" and "if" as used herein can be interpreted as "at the time of" or "when" or "in response to determination".

[0060] The terms "at least one", "multiple", "each", "any", etc. used in this application, at least one includes one, two or more, multiple includes two or more, each refers to each of the corresponding multiple, and any refers to any one of the multiple.

[0061] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0062] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0063] In order to make the inventive concept of the present application easy to understand, before describing the embodiments of the present application in detail, the English abbreviations (terms) / related concepts involved in the embodiments of the present application are first described. The English abbreviations (terms) / related concepts involved in the embodiments of the present application are subject to the following explanations.

[0064] Domain name: Domain names are used to identify the names of computers and networks on the Internet. A complete domain name usually consists of a top-level domain name (TLD) and a second-level domain name (SLD). For example, example.com includes the second-level domain name example and the top-level domain name com. Domain names not only make it easier for users to remember and identify websites, but also reflect the nature of the website, the industry it belongs to, or the geographical location.

[0065] Domain name certificate: Domain name certificate is an electronic certificate, also known as domain name SSL certificate (SSL is the Secure Sockets Layer protocol). It is a digital certificate used to prove the ownership of a domain name and provide encrypted communication services. It is like the "ID card" of the domain name, used to verify the legitimacy of the domain name owner and to ensure the security of data in network communications.

[0066] Filing: Filing is a comprehensive concept covering IP filing and domain name filing. IP filing is the process of Internet Service Providers (ISPs) or Internet Content Providers (ICPs) registering and filing the IP address information they use with the relevant management department. Domain name filing is the process of registering and filing domain name information (including domain name owner, domain name purpose, etc.) with the relevant national management department.

[0067] CDN (Content Delivery Network) is a content distribution network. CDN technology builds an intelligent virtual network by deploying node servers around the world to achieve content distribution nearby and improve transmission speed and stability. CDN can direct user requests to the node server closest to the user based on the user's location, network status and load conditions, effectively reducing the data transmission distance and network latency, speeding up content loading and improving user experience. At the same time, CDN can also improve the stability of the website. When the source server fails, it can continue to provide static content to ensure the availability of the website. By optimizing the content transmission path, CDN solves the problem of Internet congestion and improves the response speed of users visiting the website. It is an important technical support for many websites and online services.

[0068] DNS: DNS (Domain Name System) is a basic service of the Internet. Its main function is to convert domain names that are easy to remember into IP addresses that can be recognized by computers. In this way, when users visit a website, they only need to enter the domain name without having to remember the complicated IP address. For example, when you enter "www.example.com", DNS will convert it into the corresponding IP address, such as "192.168.1.1", so that the computer can locate and access the website.

[0069] NetFlow: NetFlow is a widely used standard for network traffic statistics. The NetFlow system provides detailed traffic analysis by capturing information such as the timestamps of the first and last packets of the flow, the total number of bytes and packets exchanged, and a summary of the flags used in TCP connections. This data can help identify abnormal traffic patterns in the network, potential network security threats such as DDoS attacks, and perform traffic optimization and network planning.

[0070] CR equipment: CR equipment refers to core routers. Core routers are key devices located at the center of the network, mainly responsible for forwarding data traffic between different ISP (Internet Service Provider) networks.

[0071] CNAME: CNAME (Canonical Name) is a record type in the Domain Name System (DNS) that is used to map a domain name (or subdomain) to another domain name. CNAME records are usually used to point a domain name to another domain name, rather than directly to an IP address.

[0072] With the rapid development of the Internet, content delivery network (CDN) technology is increasingly used in content distribution. CDN is a distributed server system that can improve the transmission speed and availability of Internet content by deploying servers in multiple geographical locations. CDN caches content on edge servers close to users, reducing the distance between users and source servers, thereby speeding up content loading.

[0073] However, there are still some Internet applications that use CDN to distribute content without authorization, which leads to resource abuse and network security risks. This is mainly reflected in the following aspects:

[0074] 1. Resource theft: Some people may use CDN services to steal other people’s legitimate content, such as unauthorized video, music, or software download links, to illegally gain economic benefits.

[0075] 2. Dissemination of prohibited content: CDN is used as a distribution channel for illegal, harmful or prohibited content, such as obscene and pornographic materials, malware, malicious advertisements or content involving copyright infringement.

[0076] 3. Cyberattacks: Malicious users may use CDNs to conduct distributed denial of service attacks (DDoS) by dispersing traffic to multiple sources to mask their true identity and increase the power of the attack.

[0077] 4. Information theft: Hackers or criminals can steal users’ personal sensitive information, account credentials or other confidential data by manipulating CDN services.

[0078] 5. Illegal advertising push: There may be some bad advertisers who abuse CDN services, interfere with users' browsing experience through malicious advertising plug-ins or pop-ups, or use fraudulent means to guide users to visit dangerous websites.

[0079] 6. Hacker attack infrastructure: Criminals may use CDN services as infrastructure for hacker attacks, including hosting malware, command and control servers, and conducting phishing activities.

[0080] 7. Tampering with website content: Malicious users can manipulate CDN services to tamper with website content, including modifying page information, inserting malicious code, or committing fraud, thereby causing damage to users.

[0081] 8. Bypassing geographic restrictions: Some users may use CDN to bypass geographic restrictions and access content or services in restricted areas, which may involve pirated content, illegal activities, or bypassing copyright protection mechanisms.

[0082] 9. Piracy and intellectual property infringement: CDN services may be abused to distribute pirated software, movies, music and other copyrighted content, thereby infringing the intellectual property rights of the original creators.

[0083] 10. Anti-competitive behavior: Some companies may abuse CDN services to engage in anti-competitive behavior, such as blocking competitors’ content delivery and interfering with users’ access to competitors’ websites, in order to gain an unfair competitive advantage.

[0084] Related technologies mainly screen illegal content distribution behaviors by monitoring CDN traffic. This method has problems such as limited detection range, insufficient accuracy, and difficulty in large-scale screening.

[0085] In view of this, the present application proposes an analysis method and related equipment for checking illegal content distribution based on multiple information bases. The scheme obtains IP address information with abnormal traffic, and the IP address information with abnormal traffic includes IP filing information; secondly, obtains the domain name information corresponding to the IP address with abnormal traffic; thirdly, performs certificate chain parsing on the IP address information with abnormal traffic to obtain certificate information; finally, determines whether there is illegal content distribution based on the IP filing information, certificate information and domain name information. The embodiment of the present application first starts with the IP address information with abnormal traffic, which can narrow the scope of investigation, and further obtains the IP filing information, domain name information and certificate information of the IP address information with abnormal traffic. It determines whether there is illegal content distribution through the three key information of IP filing information, certificate information and domain name information, which can improve the detection accuracy of illegal content distribution behavior.

[0086] The method provided in the embodiment of the present application can be applied to the electronic device provided in the embodiment of the present application, wherein the electronic device can be a terminal or a server.

[0087] The terminal may be a tablet computer, a laptop computer, a desktop computer, etc., but is not limited thereto.

[0088] The server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content distribution networks, as well as big data and artificial intelligence platforms.

[0089] It should be noted that in each specific implementation method of the present application, when it comes to performing relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent must be obtained first, and the collection, use, and processing of such data will comply with relevant laws, regulations, and standards.

[0090] The following will describe in detail the implementation steps of an analysis method for checking the distribution of illegal content based on multiple information libraries provided in an embodiment of the present application in conjunction with the accompanying drawings.

[0091] Please refer to Figure 1 , Figure 1 It is a flowchart of an analysis method for checking the distribution of illegal content based on multiple information bases provided by some embodiments of the present application. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a different order than here.

[0092] The method of the embodiment of the present application comprises the following steps:

[0093] Step 101: Acquire IP address information of abnormal traffic, where the IP address information of abnormal traffic includes IP record information;

[0094] Step 102: Obtain domain name information corresponding to the IP address with abnormal traffic;

[0095] Step 103: parsing the certificate chain of the IP address information with abnormal traffic to obtain certificate information;

[0096] Step 104: Determine whether there is any illegal content distribution based on the IP filing information, certificate information and domain name information.

[0097] Exemplarily, the registration information of the IP address with abnormal traffic can be obtained through the IP registration library, including the registration entity, registration number, registration time, etc.; the certificate information of the IP address with abnormal traffic can be obtained, including SSL / TLS certificates, to confirm its validity, issuing authority, validity period, etc.; the domain name information corresponding to the IP address with abnormal traffic can be obtained, including the registration information of the domain name, such as the registrant, registration time, expiration time, etc.

[0098] Further confirm whether the registrant is legal and whether it is consistent with the actual operating entity; check whether the registration number is authentic and valid and whether it matches the registrant.

[0099] Confirm through the certificate chain whether the certificate is issued by a trusted CA, check the validity period of the certificate to ensure that it has not expired, and verify whether the domain name in the certificate is consistent with the actual domain name used.

[0100] Confirm through the domain name gene library whether the domain name registrant is legal and consistent with the registered entity; check the domain name registration time, expiration time, and whether there are frequent change records.

[0101] Based on the above analysis results, it can be determined whether there is any illegal content distribution.

[0102] Steps 101 to 104 shown in the embodiment of the present application first start with the IP address information of the abnormal traffic, which can narrow the scope of investigation. Further, the IP registration information, domain name information and certificate information of the IP address information of the abnormal traffic are obtained. The three key information of IP registration information, certificate information and domain name information are combined to determine whether there is illegal content distribution, which can improve the detection accuracy of illegal content distribution behavior.

[0103] The specific implementation methods of the above steps are introduced below.

[0104] Before obtaining the IP address information of abnormal traffic, it is necessary to lock the IP address of abnormal traffic through traffic data. For specific methods, please refer to the attached Figure 3 , Figure 3 This is a flowchart of a method for determining IP address information of traffic anomaly provided in some embodiments of the present application.

[0105] The method for determining the traffic abnormality IP address information includes the following steps:

[0106] Step 301: Obtain network traffic data;

[0107] Step 302: Perform offline statistical analysis on network traffic data in a preset time period to obtain analysis results;

[0108] Step 303: Determine the IP address information of the traffic anomaly based on the analysis result.

[0109] Optionally, traffic data can be collected through Netflow.

[0110] Exemplarily, the CR devices in the national administrative region of operator country A can be collected based on IP full-port traffic through the NetlowV5 or NetflowV9 protocol, and the collected data can be parsed into JSON format for storage. Among them, JSON (JavaScript Object Notation) is a lightweight data exchange format that is easy for people to read and write, and is also easy for machines to parse and generate. It should be understood that the collected data can also be saved in other data formats that are easy to analyze, such as XML (eXtensible Markup Language) format, YAML (YAML Ain't Markup Language) format or MessagePack format, and this application does not limit this.

[0111] The NetlowV5 protocol is easy to implement due to its fixed template and limited fields; the template design of the NetlowV9 protocol makes it very flexible and can adapt to the ever-changing network environment and new traffic analysis requirements, thus providing more functionality and flexibility.

[0112] Collecting traffic data through Netflow can provide detailed traffic information, including source and destination IP addresses, source port, destination port, collection time, source autonomous system number (source AS number), destination AS number, protocol type, number of packets and bytes, etc. This information helps to understand the distribution and trend of network traffic in the future.

[0113] It should be understood that the embodiments of the present application can also use other traffic data collection tools, such as the SolarWinds Hybrid Cloud Observability tool (which supports real-time monitoring of network traffic and detection of potential problems) or ManageEngine NetFlow Analyzer (which provides real-time network traffic reports and detailed traffic analysis), and the present application does not limit this.

[0114] Optionally, the acquired network traffic data may be subjected to offline statistical analysis in a preset time period to obtain analysis results.

[0115] The preset time period can be flexibly set according to idle computing resources or the size of the acquired traffic, for example, the preset time period can be set to 1 day or 2 days. Specifically, the acquired traffic data can be partitioned by day, and offline statistical analysis can be performed by day.

[0116] For example, traffic analysis tools or scripts can be used to analyze the collected data, specifically focusing on traffic size, that is, checking whether there is abnormally large traffic; traffic pattern, that is, analyzing traffic patterns, such as a sudden increase or decrease in traffic; protocols and ports, that is, checking whether there are abnormal protocols or port activities; checking whether traffic duration is abnormally long or short or traffic flow is unusual, such as a sudden large amount of internal network traffic flowing to the external network, etc.

[0117] Based on the analysis results, IP addresses with abnormal traffic can be identified, such as IP addresses with abnormally large traffic, IP addresses associated with known malicious activities, or IP addresses with abnormal protocol or port activities. Furthermore, information related to the IP addresses with abnormal traffic can be obtained. For example, IP filing information. The IP address can be accurately located to the registered customer.

[0118] The embodiment provided in the present application obtains network traffic data, performs offline statistical analysis on the network traffic data during a preset time period, obtains analysis results, and determines the IP address information of the traffic anomaly based on the analysis results, thereby providing a decision-making basis for subsequently determining whether there is any illegal content distribution.

[0119] While obtaining network traffic data, you can also obtain domain name system log information simultaneously.

[0120] Please refer to Figure 4 , Figure 4 It is a flowchart of a method for determining domain name information provided by some embodiments of the present application.

[0121] The method for determining domain name information includes the following steps:

[0122] Step 401: Obtain domain name system log data;

[0123] Step 402: Based on the domain name system log data, determine the domain name and the IP address information corresponding to the domain name.

[0124] For example, the DNS log data of each province can be collected into a centralized data storage device through collection servers deployed by operators in each province, and the data can be partitioned by day, and offline statistical analysis can be performed on the DNS log data on a daily basis.

[0125] The domain name system log data (DNS log data) includes but is not limited to the following information: domain name, CNAME, resolution IP, port, collection time, request IP, etc.

[0126] DNS log data can be used to parse domain names, CNAMEs, IP addresses and other information.

[0127] For example, the way to obtain the domain name system log data is to connect a splitter in series between the link between the DNS switch and the CR or to mirror the link between the DNS switch and the CR to collect and transmit the data to a centralized storage device, and the data is stored on HDFS (Hadoop Distributed File System). HDFS is mainly used to store and manage large-scale data sets. It is a distributed file system that can reliably store large data sets on cheap hardware and provide high-throughput data access capabilities.

[0128] After obtaining network traffic data and domain name system log information, the illegal content distribution behavior can be judged based on the above information combined with some specific information.

[0129] These specific information may include IP registration information, certificate information and domain name information.

[0130] The following introduces the specific methods of obtaining IP registration information, certificate information and domain name information.

[0131] In step 101, the IP address information of the abnormal traffic is obtained, and the IP address information of the abnormal traffic includes IP filing information.

[0132] The above embodiment has introduced the method for determining the IP address information of abnormal traffic (see steps 301 to 303).

[0133] Based on the determined IP address information of abnormal traffic, the IP address related attribution information can be further obtained through the IP address filing system.

[0134] IP filing information usually includes basic information of the filing unit, IP address source information, IP address allocation and use information, etc. For example, the basic information of the filing unit may include the name of the filing unit: for example, a certain technology company; the address of the filing unit: for example, No. XX, a certain road, District C, City B; the nature of the filing unit: for example, a private enterprise and contact person related information.

[0135] The embodiment of the present application can determine the IP attribution information (filing unit) of the traffic anomaly by obtaining the IP filing information of the traffic anomaly, thereby providing a decision-making basis for subsequent judgment on illegal content distribution behavior.

[0136] In step 102, domain name information corresponding to the IP address with abnormal traffic is obtained.

[0137] The above embodiment has introduced the method for determining the domain name information, through which the domain name and IP address information are associated.

[0138] It should be understood that the DNS log data includes but is not limited to the domain name, CNAME, resolution IP, port, collection time, request IP, etc. Therefore, the domain name, CNAME, etc. information can be parsed based on the DNS log data, and the domain name gene library can also be used to determine the domain name ownership information and CNAME ownership information.

[0139] In some embodiments of the present application, domain name information includes domain name ownership information and CNAME ownership information, and the domain name ownership information and CNAME ownership information corresponding to the IP address with abnormal traffic can be determined through a domain name gene library, wherein the domain name gene library is used to represent a global domain name information database including IP address information and domain name registration information.

[0140] It should be understood that the domain name gene bank is a global domain name information database, which includes IP address information and domain name registration information, and may also include the ICP filing information of the Ministry of Industry and Information Technology. In other words, a global domain name information database can be established based on the operator's IP address filing system, domain name registration information, and the ICP filing information of the Ministry of Industry and Information Technology. Among them, domain name registration information mainly includes the following aspects: domain name owner information, registrar information, domain name server information, domain name DNS information (the correspondence between host name and IP address), etc. The ICP filing information of the Ministry of Industry and Information Technology mainly includes sponsor information, website information, website access information, etc. CNAME attribution information can be indirectly obtained through ICP filing information.

[0141] Therefore, the domain name gene library can be used to determine the corresponding domain name ownership information (domain name owner information) and canonical name (CNAME) ownership information based on the IP address with abnormal traffic.

[0142] See also Figure 2 , Figure 2 This is another flow chart of an analysis method for checking the distribution of illegal content based on multiple information repositories provided in some embodiments of the present application. Figure 2 The steps in the example include:

[0143] Step 201: Acquire IP address information of abnormal traffic flow, where the IP address information of abnormal traffic flow includes IP record information;

[0144] Step 202: Determine the domain name ownership information and the canonical name ownership information corresponding to the IP address with abnormal traffic through the domain name gene library;

[0145] Step 203: parsing the certificate chain of the IP address information with abnormal traffic to obtain certificate information;

[0146] Step 204: Determine whether there is any illegal content distribution based on the IP filing information, certificate information, domain name ownership information and standard name ownership information.

[0147] Exemplarily, the registration information of the IP address with abnormal traffic can be obtained through the IP registration library, including the registration entity, registration number, registration time, etc.; the certificate information of the IP address with abnormal traffic can be obtained, including SSL / TLS certificates, to confirm its validity, issuing authority, validity period, etc.; the domain name ownership information and CNAME ownership information corresponding to the IP address with abnormal traffic can be determined through the domain name gene library.

[0148] Further confirm whether the registrant is legal and whether it is consistent with the actual operating entity; check whether the registration number is authentic and valid and whether it matches the registrant.

[0149] Confirm that the certificate is issued by a trusted CA, check the certificate's validity period to ensure it has not expired, and verify that the domain name in the certificate is consistent with the actual domain name used.

[0150] Confirm whether the domain name registrant (domain name ownership information) is legal and consistent with the registered entity; check whether the CNAME ownership information is legal and consistent with the registered entity, etc.

[0151] Based on the above analysis results, it can be determined whether there is any illegal content distribution. For example, when there is inconsistency with the filing subject or the user organization of the certificate is inconsistent with the domain name ownership information, it can be further analyzed whether there is a legal relationship between the two. If there is no legal relationship, it is considered that there is illegal content distribution.

[0152] The embodiment of the present application determines whether there is illegal content distribution through IP registration information, certificate information, domain name ownership information and standard name ownership information, which can improve the accuracy of illegal content distribution detection.

[0153] In step 103, the certificate chain may be parsed for the IP address information of the abnormal traffic to obtain the certificate information.

[0154] For example, the certificate chain can be parsed for the high-traffic IP address in Netflow statistics to obtain information such as the using organization, user common name, issuing organization, and validity period in the SSL certificate.

[0155] Specifically, the collected Netflow data can be analyzed to identify high-traffic IP addresses. These IP addresses may be key nodes in the network. For the identified high-traffic IP addresses, obtain their corresponding SSL certificates. For example, for a Web server, an SSL certificate can be obtained by initiating an SSL / TLS handshake. The obtained certificate may be a certificate chain, including a server certificate, an intermediate certificate, and a root certificate. It is necessary to parse this certificate chain, extract the information of each certificate, and extract key information from each certificate, such as the using organization, the user common name, the issuing organization, the validity period, etc. For non-Web services, you may need to use a specific client or tool to obtain the SSL certificate. For example, for the SMTP service, you can use the command "openssl s_client-starttls smtp-connect server.com:25" to obtain the certificate.

[0156] In some implementations, the certificate information includes certificate user information, and the IP address information with abnormal traffic can be parsed based on the certificate chain to obtain the certificate user information.

[0157] See also Figure 5 , Figure 5 This is another flow chart of an analysis method for checking the distribution of illegal content based on multiple information repositories provided by some embodiments of the present application. Figure 5 The steps in the example include:

[0158] Step 501: Acquire IP address information of abnormal traffic flow, where the IP address information of abnormal traffic flow includes IP record information;

[0159] Step 502: Obtain the domain name information corresponding to the IP address with abnormal traffic;

[0160] Step 503: parsing the certificate chain of the IP address information with abnormal traffic to obtain certificate user information;

[0161] Step 504: Determine whether there is any illegal content distribution based on the IP registration information, certificate user information and domain name information.

[0162] The specific implementation method of step 501 to step 503 can refer to the introduction in the above embodiment.

[0163] Based on the IP filing information, certificate user information and domain name information, determine whether there is illegal content distribution. You can compare the website information in the IP filing information with the certificate user information to check whether there are inconsistencies or contradictions, and conduct content review on the filing website and the website associated with the certificate user to check whether there is illegal content. According to relevant laws, regulations and industry standards, check whether the IP filing information, certificate user information and domain name information comply with the regulations. In this way, determine whether there is illegal content distribution.

[0164] The embodiment provided in the present application determines whether there is illegal content distribution through IP filing information, certificate user information and domain name information, and correlates and analyzes the IP filing information, certificate user information and domain name information, which can improve the accuracy of illegal content distribution detection.

[0165] In step 104, it is determined whether there is any illegal content distribution based on the IP registration information, certificate information and domain name information.

[0166] IP registration information usually includes basic information of the registration unit, IP address source information, and IP address allocation and use information.

[0167] Certificate information usually includes the using organization, user common name, issuing organization, validity period information, etc.

[0168] Domain name information may include domain name, CNAME, domain name ownership information and CNAME ownership information, etc.

[0169] The IP registration information, certificate information and domain name information can be used to determine whether illegal content is being distributed.

[0170] For example, it can confirm whether the IP registration unit is legal and whether it is consistent with the actual operating entity; check whether the registration number is authentic and valid and whether it matches the registration entity.

[0171] Confirm that the certificate is issued by a trusted CA, check the certificate's validity period to ensure it has not expired, and verify that the user organization of the certificate is the same as the registrant of the domain name.

[0172] Confirm whether the domain name registrant (domain name ownership information) is legal and consistent with the registered entity; check whether the CNAME ownership information is legal and consistent with the registered entity, etc.

[0173] Based on the above analysis results, it can be determined whether there is any illegal content distribution. For example, when there is inconsistency with the filing subject or the user organization of the certificate is inconsistent with the registrant information of the domain name, it can be further analyzed whether there is a legal relationship between the two. If there is no legal relationship, it is considered that there is illegal content distribution.

[0174] In some embodiments, the IP registration information includes the IP registration unit, the domain name information includes domain name ownership information and CNAME ownership information, and the certificate information includes certificate user information. It can be determined whether there is illegal content distribution based on the IP registration unit, domain name ownership information, canonical name ownership information and certificate user information.

[0175] Optionally, if there is one or more inconsistent information in the IP registration unit, domain name ownership information, standard name ownership information and certificate user information, then it is necessary to conduct a compliance assessment on the inconsistent information, obtain the assessment results, and determine whether there is any illegal content distribution based on the assessment results.

[0176] After obtaining the IP record unit, domain name ownership information, standard name ownership information and certificate user information, the obtained information can be further verified to ensure the authenticity of the information. If there is one or more inconsistent information in this information, it is necessary to further analyze the cause of the inconsistent information and conduct a legal and normative assessment of the cause to determine whether there is any illegal content distribution behavior.

[0177] In some embodiments, a compliance assessment is performed on the inconsistent information to obtain an assessment result, which may be to obtain content distribution network qualification indication information and content distribution network resource sublease indication information. If the content distribution network qualification indication information indicates that the inconsistent information does not have content distribution network (CDN) qualifications or the content distribution network resource sublease indication information indicates that the inconsistent information is a resource sublease, then a violation assessment result is output.

[0178] Inconsistent information may be the inconsistency between the IP recordation unit and the certificate user, or the inconsistency between the IP recordation unit and the domain name ownership information. If there is inconsistent information, further analysis can be performed on the two, such as determining whether one of the parties has CDN qualifications, or determining whether one of the parties is involved in CDN secondary distribution. If one of the parties has CDN qualifications, or is involved in CDN secondary distribution, it is a normal proxy and conforms to normal content distribution behavior. If it does not have CDN qualifications or is directly subletting resources, it may be an illegal proxy.

[0179] See also Figure 6 , Figure 6 yes Figure 1 Flow chart of step 104 in FIG.

[0180] Figure 6In the process, after obtaining the IP filing unit, domain name ownership information, canonical name ownership information and certificate user information, determine whether there is inconsistent information in the IP filing unit, domain name ownership information, canonical name ownership information and certificate user information. If the information is consistent, that is, the IP filing unit, domain name ownership information, canonical name ownership information and certificate user information point to the same user, then its distribution behavior is considered to be compliant; if the IP filing unit, domain name ownership information, canonical name ownership information and certificate user information point to multiple users, then it is considered that there is inconsistent information in the IP filing unit, domain name ownership information, canonical name ownership information and certificate user information. Furthermore, it is necessary to determine whether the inconsistent information has CDN qualifications. If it has CDN qualifications, its distribution behavior is considered to be compliant; if it does not have CDN qualifications, its distribution behavior is considered to be non-compliant.

[0181] Figure 7 yes Figure 1 Another flowchart of step 104 in , describes another way to determine whether the content distribution behavior is compliant.

[0182] Figure 7 In the process, after obtaining the IP filing unit, domain name ownership information, canonical name ownership information and certificate user information, determine whether there is any inconsistent information in the IP filing unit, domain name ownership information, canonical name ownership information and certificate user information. If the information is consistent, that is, the IP filing unit, domain name ownership information, canonical name ownership information and certificate user information point to the same user, then the distribution behavior is considered to be compliant; if the IP filing unit, domain name ownership information, canonical name ownership information and certificate user information point to multiple users, then the IP filing unit, domain name ownership information, canonical name ownership information and certificate user information are considered to have inconsistent information. Furthermore, it is necessary to determine whether the inconsistent information is CDN secondary distribution. If it involves CDN secondary distribution, then the distribution behavior is considered to be compliant; if it does not involve CDN secondary distribution, but the resources are directly sublet, then the distribution behavior is considered to be non-compliant.

[0183] The embodiment provided by this application determines whether there is illegal content distribution based on IP filing information, certificate information and domain name information. Specifically, it determines whether there is illegal content distribution based on whether the IP filing unit, domain name ownership information, standard name ownership information and certificate user information point to the same user. It can focus on the problem itself and directly check CDN violations through the most core information, reduce the misjudgment rate, and improve the accuracy of violation detection. By comparing IP filing information and domain name ownership information, unauthorized CDN resale behavior can be quickly discovered and marked, reducing network security risks.

[0184] In some implementations of the present application, IP registration information, certificate information, domain name information, and information on whether there is any illegal content distribution may also be stored and / or a visual analysis report may be generated.

[0185] It should be understood that in the process of determining the IP address information and domain name information of traffic anomalies, it may involve accurately matching the source IP, destination IP, source port, destination port, collection time, source autonomous system number (AS number), destination AS number and other entry information in the Netflow data with the domain name, resolution IP, port, collection time, request IP and other information in the DNS log, and correlating the traffic data with the domain name related data based on the correlation of timestamp, IP address and port as the core basis, and comprehensively analyzing and matching the IP address, domain name information and traffic. This process involves the storage and analysis of data.

[0186] Please refer to Figure 8 , Figure 8 This is a data collection and storage flow chart provided by some embodiments of the present application.

[0187] Figure 8 In the process, the input data traffic is divided into two paths. One path passes through the CR device and then flows into the Netflow collection server to collect and analyze the traffic component information. The other path passes through the DNS server and flows into the DNS collection server to collect and analyze the DNS information. After that, the collected and analyzed data is stored in the data storage module.

[0188] For example, for DNS collection, an optical splitter may be connected in series between the link between the DNS switch and the CR or the link from the DNS switch to the CR may be mirrored to transmit the collected data to a centralized storage device, and the data may be stored on HDFS.

[0189] For Netflow collection, the flow composition information of the network's export devices can be collected through the NetFlowV5 or NetFlowV9 protocol, and the data is stored on HDFS.

[0190] Fig. 9 Involves the data collection and analysis process. Fig. 9 In the process, one path of traffic data passes through the CR core router, Netflow collection, Kafka reception (an open source distributed stream processing platform) to Flink analysis, and the other path of traffic data passes through the DNS server, to DNS collection, and then FTP transmission, through the data node to Flink analysis, and the Flink analysis results are displayed.

[0191] Kafka is a distributed stream processing platform that is mainly used to build real-time data stream pipelines and stream processing applications. It can receive data collected by Netflow and store this data in Kafka topics. Then, this data can be transmitted to other systems, such as Flink analysis, for real-time data processing and analysis.

[0192] Flink analysis is mainly used to process real-time data streams and batch data sets. It provides a distributed, high-performance stream processing framework that can be used in scenarios such as real-time data processing, event-driven applications, data integration, and data warehouses. Flink analysis can perform real-time calculations, aggregation, filtering, and conversions on data, and output the results to various storage systems. In the embodiment of the present application, Flink is used to calculate and analyze the data collected through Netflow and DNS data to obtain analysis results.

[0193] The above introduces the storage and analysis process of the collected data in the embodiments of the present application.

[0194] When storing IP filing information, certificate information, domain name information and whether there is illegal content distribution information and / or generating a visual analysis report, key information can be stored and / or displayed based on the above-collected, stored and analyzed data.

[0195] Among them, visualization display may include methods such as data visualization and information visualization. Among them, data visualization can be displayed using chart types (bar charts, line charts, pie charts, histograms, etc.), interactive methods (filtering, aggregation, sorting), 3D visualization, and dynamic visualization; information visualization can use infographics and information box display methods, visual design elements (color, texture and pattern, etc.), data mapping display methods, network and relationship diagrams, and other display methods, and this application does not impose any restrictions on this.

[0196] Exemplarily, data on illegal content distribution can be visualized, and specifically one or more of the following information can be displayed: IP address, IP ownership, certificate chain platform, domain name, domain name ownership customer, CNAME, CNAME ownership, traffic, whether illegal content distribution is involved, and other information.

[0197] The embodiments provided in the present application can ensure the persistence of data by storing IP registration information, certificate information, domain name information and information on whether there is illegal content distribution and / or generating visual analysis reports, which is conducive to subsequent data query, audit and compliance inspection; it is also conducive to converting complex data into easy-to-understand charts and graphs to improve user experience; the generation of visual analysis reports can be automated, generated regularly and sent to relevant personnel, saving time in manual report preparation and improving work efficiency.

[0198] The following is a detailed description and explanation of the solution of the embodiment of the present invention in conjunction with a specific application example:

[0199] In an embodiment of the present application, an analysis method for checking illegal content distribution based on multiple information libraries is provided. The method is used to check for unauthorized content distribution using CDN in the network. It can actively check for illegal CDN behavior in a massive data environment and improve network security management.

[0200] For details, please refer to Fig.10 , Fig.10 This is another flow chart of an analysis method for checking the distribution of illegal content based on multiple information repositories provided in some embodiments of the present application.

[0201] Fig.10 In the process, Netflow collection and DNS collection of traffic data are involved. For example, a splitter can be connected in series to the link between the DNS switch and the CR, or the link from the DNS switch to the CR can be mirrored to collect data and transmit it to a centralized storage device, and the collected data can be stored on HDFS to implement DNS collection of traffic data. The traffic component information of the network's egress device can be collected through the NetFlowV5 or NetFlowV9 protocol, and the data can be stored on HDFS to implement Netflow collection of traffic data. The IP information of abnormal traffic, such as large traffic IP information, can be determined through the collected data.

[0202] For the data collected by Netflow, IP filing and analysis can be performed using the operator's national filing system for allocating and managing IP addresses to analyze customer usage of high-traffic IPs, including obtaining IP address-related ownership information.

[0203] Perform domain name resolution on the collected DNS information, including resolving domain names, CNAME and other information in the DNS log; use the domain name gene library to determine the customer to whom the domain name belongs and the customer to whom the CNAME belongs.

[0204] Perform certificate chain analysis on high-traffic IP addresses in Netflow statistics, including obtaining the using organization, user common name, issuing organization, validity period and other information in the SSL certificate to establish a comprehensive network data association.

[0205] After that, Netflow and DNS log data are combined, matched based on IP, time, port, etc., and the full correlation data of traffic data and domain name, CNAME, certificate chain platform, etc. is output. The source IP, destination IP, source port, destination port, collection time, source AS number, destination AS number and other entry information in Netflow data are accurately matched with the domain name, resolution IP, port, collection time, request IP and other information in the DNS log. With the correlation of timestamp, IP address and port as the core basis, the traffic data is accurately correlated with the domain name related data, and the IP address, domain name information and traffic are comprehensively analyzed and matched.

[0206] Comprehensive DNS logs, domain name gene library, IP record library and certificate chain platform information are matched and analyzed, and the information of inconsistent customer information in each data is output based on customer information, to evaluate whether there is any illegal CDN behavior, and finally output the judgment conclusion of whether it is illegal. Through in-depth integration and comprehensive logical analysis of inconsistent customer information items, certificate chain resolution results, domain name resolution data and various data involved in the analysis and judgment process of illegal content distribution, the legality and standardization of CDN agent behavior are comprehensively evaluated, and a conclusive report containing key contents such as whether there is illegal CDN behavior, the type of illegal behavior, the specific domain name involved, IP address range, relevant customer information and the severity of the illegal behavior is generated.

[0207] Exemplarily, the collected data is analyzed, and the high-traffic IP-related information is obtained through the IP registration library: Digital Life Department 61.172.*.* (IP address); through the certificate chain platform parsing module, the certificate chain platform information is obtained: user common name (CN) download.ks-cdn.com; user organization (O) A City A Technology Co., Ltd.; issuing organization (O) Sectigo Limited; issuance date 2023 month and day hour and minute; expiration date 2024 month and day hour and minute; through the domain name basic gene library, domain name related information is obtained: zell.dl.playstation.net B Entertainment Co., Ltd.; through the domain name basic gene library, CNAME related information is obtained: kjyundn.comA City A Technology Co., Ltd.

[0208] Through the above information, namely IP registration, certificate chain platform, domain name, and CNAME customer attribution information, it can be concluded that A Technology Co., Ltd. in City A uses the IP of the Digital Life Department to act as an agent for the services of B Entertainment Co., Ltd.

[0209] Furthermore, it is determined whether A Technology Co., Ltd. in City A and the Digital Life Department have CDN qualifications and whether they are CDN secondary distribution. If they have CDN qualifications or are CDN secondary distribution, they are normal agents. If they do not have CDN qualifications or are directly subletting resources, they may be illegal agents. In this case, A Technology Co., Ltd. in City A used the resources of the Digital Life Department for CDN distribution, which was suspected of secondary resale and was judged to be an illegal content distribution business.

[0210] Furthermore, by accurately matching the source IP, destination IP, source port, destination port, collection time, source AS number, destination AS number and other entry information in the Netflow data with the DNS log, the flow data and domain name related data are accurately associated, and the IP address, domain name information and flow are comprehensively and accurately matched. The results are directly saved in the database and displayed on the page. An example is shown in Table 1.

[0211] Table 1 CDN violation information table

[0212]

[0213] The above is an introduction to an embodiment of the analysis method for checking the distribution of illegal content based on multiple information repositories provided in this application.

[0214] The implementation of the analysis device for checking illegal content distribution behavior based on multiple information libraries provided in the embodiment of the present application will be described in detail below with reference to the accompanying drawings.

[0215] For the analysis method for checking the distribution of illegal content based on multiple information bases provided in the above embodiment, the embodiment of the present application also provides an analysis device for checking the distribution behavior of illegal content based on multiple information bases, which is used to implement the above method, such as Fig.11 As shown, Fig.11 This is a schematic block diagram of a module of an analysis device for checking illegal content distribution behavior based on multiple information bases according to an embodiment of the present application. The illegal content distribution behavior analysis device 1100 includes:

[0216] The first acquisition module 1101 is used to acquire IP address information of abnormal traffic flow, where the IP address information of abnormal traffic flow includes IP record information;

[0217] The second acquisition module 1102 is used to obtain the domain name information corresponding to the IP address with abnormal traffic;

[0218] The certificate chain parsing module 1103 is used to parse the certificate chain of the IP address information of the abnormal traffic to obtain the certificate information;

[0219] The violation analysis module 1104 is used to determine whether there is any illegal content distribution based on the IP registration information, certificate information and domain name information.

[0220] It can be understood that the contents of the above method embodiments are all applicable to the present device embodiments, the functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0221] like Fig.12 As shown, the embodiment of the present application further provides an electronic device, the electronic device 1200 includes a memory 1201, one or more processors 1202 ( Fig.12 Only one is shown) and a computer program stored in the memory 1201 and executable on the processor 1202. Among them: the memory 1201 is used to store software programs and units, and the processor 1202 executes various functional applications and data processing by running the software programs and units stored in the memory 1201 to obtain the resources corresponding to the above-mentioned preset events. Optionally, the processor 1202 implements the above-mentioned analysis method for checking the distribution of illegal content based on multiple information bases by running the above-mentioned computer program stored in the memory 1201.

[0222] The memory 1201, as a non-transitory computer-readable medium, can be used to store non-transitory software programs and non-transitory computer executable programs. In addition, the memory 1201 may include a high-speed random access memory, and may also include a non-transitory memory, such as at least one disk storage device, a flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory 1201 may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor 1202 via a network.

[0223] It can be understood that the contents of the above method embodiments are all applicable to the electronic device embodiment, the functions specifically implemented by the electronic device embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0224] An embodiment of the present application also provides a computer program product, which includes a computer program. When the computer program is executed by one or more processors, it can implement the steps of the above-mentioned analysis method for checking the distribution of illegal content based on multiple information libraries.

[0225] It can be understood that the contents of the above method embodiments are all applicable to the present computer program product, the functions specifically implemented by the present computer program product embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0226] The analysis method, device, electronic device, medium and computer program product for checking illegal content distribution based on multiple information bases provided in the embodiment of the present application, first, obtain the IP address information of abnormal traffic, and the IP address information of abnormal traffic includes IP filing information; secondly, obtain the domain name information corresponding to the IP address of abnormal traffic; thirdly, perform certificate chain analysis on the IP address information of abnormal traffic to obtain certificate information; finally, determine whether there is illegal content distribution based on IP filing information, certificate information and domain name information. The embodiment of the present application first starts with the IP address information of abnormal traffic, which can narrow the scope of investigation, further, obtain the IP filing information, domain name information and certificate information of the IP address information of abnormal traffic, and determine whether there is illegal content distribution through the three key information of IP filing information, certificate information and domain name information, which can improve the detection accuracy of illegal content distribution behavior, and realize multi-dimensional association analysis of illegal content distribution behavior by combining domain name gene library, certificate chain and IP filing library, which improves the accuracy and reliability of illegal detection, and obtains IP, domain name, domain name ownership, traffic, flow direction, protocol type, application port and connection duration information by matching NetFlow data, so as to ensure the comprehensiveness of detection information.

[0227] The embodiments provided in the present application use an IP address registration library system to achieve accurate positioning of IP addresses, reduce the misjudgment rate, and improve the accuracy of violation detection; by collecting and analyzing NetFlow and DNS log data, it is possible to quickly identify and respond to illegal CDN behaviors in the network, thereby improving the overall network security protection capabilities; through precise IP positioning and domain name registration information comparison, it is possible to quickly discover and mark unauthorized CDN resale behaviors, thereby reducing network security risks; through automated monitoring and analysis processes, it reduces manual intervention and improves the efficiency of network management and violation detection; through effective violation detection and prevention, it maintains the fairness and security of network services and enhances users' trust and reliance on services.

[0228] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0229] Although specific embodiments are described herein, those of ordinary skill in the art will recognize that many other modifications or alternative embodiments are also within the scope of the present disclosure. For example, any of the functions and / or processing capabilities described in conjunction with a particular device or component may be performed by any other device or component. In addition, although various exemplary implementations and architectures have been described according to embodiments of the present disclosure, those of ordinary skill in the art will recognize that many other modifications to the exemplary implementations and architectures described herein are also within the scope of the present disclosure.

[0230] Some aspects of the present disclosure are described above with reference to the block diagram and flow chart of the system, method, system and / or computer program product according to the exemplary embodiments.It should be understood that the combination of one or more blocks in the block diagram and the flow chart and the blocks in the block diagram and the flow chart can be realized by executing computer executable program instructions respectively.Equally, according to some embodiments, some blocks in the block diagram and the flow chart may not need to be executed in the order shown, or may not need to be executed in full.In addition, additional components and / or operations beyond those components and / or operations shown in the blocks in the block diagram and the flow chart may be present in certain embodiments.

[0231] Therefore, the blocks in the block diagrams and flow charts support the combination of devices for performing the specified functions, the combination of elements or steps for performing the specified functions, and the program instruction devices for performing the specified functions. It should also be understood that each block in the block diagrams and flow charts and the combination of blocks in the block diagrams and flow charts can be implemented by a special-purpose hardware computer system or a combination of special-purpose hardware and computer instructions that performs a specific function, element or step.

[0232] The program modules, applications, etc. described herein may include one or more software components, including, for example, software objects, methods, data structures, etc. Each such software component may include computer-executable instructions that, in response to execution, cause at least a portion of the functionality described herein (e.g., one or more operations of the illustrative methods described herein) to be performed.

[0233] Software components can be encoded with any of various programming languages. An exemplary programming language can be a low-level programming language, such as an assembly language associated with a specific hardware architecture and / or an operating system platform. The software component comprising assembly language instructions may need to be converted to executable machine code by an assembler before being executed by hardware architecture and / or platform. Another exemplary programming language can be a higher-level programming language, which can be transplanted across multiple architectures. The software component comprising a higher-level programming language may need to be converted to an intermediate representation by an interpreter or a compiler before execution. Other examples of programming languages ​​include but are not limited to macro languages, shells or command languages, job control languages, scripting languages, database queries or search languages ​​or report writing languages. In one or more exemplary embodiments, the software component comprising the instruction of one of the above-mentioned programming language examples can be directly executed by an operating system or other software components, without first being converted into another form.

[0234] Software components may be stored as files or other data storage structures. Software components of similar type or related functions may be stored together, such as in a specific directory, folder, or library. Software components may be static (e.g., preset or fixed) or dynamic (e.g., created or modified at execution time).

[0235] The embodiments of the present application are described in detail above in conjunction with the accompanying drawings, but the present application is not limited to the above embodiments, and various changes can be made within the knowledge scope of ordinary technicians in the relevant technical field without departing from the purpose of the present application.

Claims

1. An analysis method for checking the distribution of illegal content based on multiple information bases, characterized in that: The following steps are involved: Obtaining IP address information of abnormal traffic, wherein the IP address information of abnormal traffic includes IP filing information; Obtaining the domain name information corresponding to the IP address with abnormal traffic; Performing certificate chain analysis on the IP address information of the traffic anomaly to obtain certificate information; Determine whether there is illegal content distribution based on the IP registration information, the certificate information and the domain name information.

2. The analysis method for checking the distribution of illegal content based on multiple information bases according to claim 1 is characterized in that: The domain name information includes domain name ownership information and standard name ownership information, and the obtaining of the domain name information corresponding to the IP address with abnormal traffic includes: Determine the domain name attribution information and the canonical name attribution information corresponding to the IP address with abnormal traffic through a domain name gene library, wherein the domain name gene library is used to represent a global domain name information database including IP address information and domain name registration information; The determining whether there is illegal content distribution based on the IP filing information, the certificate information and the domain name information includes: Determine whether there is illegal content distribution based on the IP filing information, the certificate information, the domain name ownership information and the standard name ownership information.

3. The analysis method for checking the distribution of illegal content based on multiple information bases according to claim 1 is characterized in that: Before obtaining the IP address information of the traffic anomaly, the method further includes: Get network traffic data; Performing offline statistical analysis on the network traffic data over a preset time period to obtain analysis results; The IP address information of the traffic anomaly is determined based on the analysis result.

4. The analysis method for checking the distribution of illegal content based on multiple information bases according to claim 1 is characterized in that: Before obtaining the IP address information of the traffic anomaly, the method further includes: Get domain name system log data; Based on the domain name system log data, a domain name and IP address information corresponding to the domain name are determined.

5. The analysis method for checking the distribution of illegal content based on multiple information bases according to claim 1 is characterized in that: The certificate information includes certificate user information, and the certificate chain is parsed for the IP address information of the traffic anomaly to obtain the certificate information, including: Performing certificate chain analysis on the IP address information of the abnormal traffic to obtain the certificate user information; The determining whether there is illegal content distribution based on the IP filing information, the certificate information and the domain name information includes: Determine whether there is illegal content distribution based on the IP registration information, the certificate user information and the domain name information.

6. The analysis method for checking the distribution of illegal content based on multiple information bases according to claim 1 is characterized in that: The IP filing information includes the IP filing unit, the domain name information includes domain name ownership information and standard name ownership information, the certificate information includes certificate user information, and the determining whether there is illegal content distribution based on the IP filing information, the certificate information and the domain name information includes: Determine whether there is illegal content distribution based on the IP filing unit, the domain name ownership information, the standard name ownership information and the certificate user information.

7. The analysis method for checking the distribution of illegal content based on multiple information bases according to claim 6 is characterized in that: The determining whether there is illegal content distribution based on the IP filing unit, the domain name ownership information, the standard name ownership information and the certificate user information includes: If one or more of the IP filing unit, the domain name ownership information, the canonical name ownership information and the certificate user information are inconsistent, a compliance assessment is performed on the inconsistent information to obtain an assessment result; Determine whether there is illegal content distribution based on the evaluation result.

8. The analysis method for checking the distribution of illegal content based on multiple information bases according to claim 7 is characterized in that: The evaluation result includes a violation evaluation result, and the compliance evaluation is performed on the inconsistent information to obtain an evaluation result, including: Obtaining content distribution network qualification indication information and content distribution network resource sublease indication information; If the content distribution network qualification indication information indicates that the inconsistent information does not have the content distribution network qualification or the content distribution network resource sublease indication information indicates that the inconsistent information is a resource sublease, the violation assessment result is output.

9. The analysis method for checking illegal content distribution based on multiple information bases according to claim 1 is characterized in that: After determining whether there is illegal content distribution based on the IP filing information, the certificate information and the domain name information, the method further includes: The IP filing information, the certificate information, the domain name information and the information on whether there is illegal content distribution are stored and / or a visual analysis report is generated.

10. An analysis device for checking illegal content distribution behavior based on multiple information bases, characterized in that: The device comprises: A first acquisition module is used to acquire IP address information of abnormal traffic, wherein the IP address information of abnormal traffic includes IP filing information; A second acquisition module is used to obtain the domain name information corresponding to the IP address with abnormal traffic; A certificate chain parsing module is used to perform certificate chain parsing on the IP address information of the traffic anomaly to obtain certificate information; The violation analysis module is used to determine whether there is any illegal content distribution based on the IP registration information, the certificate information and the domain name information.

11. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the analysis method for checking the distribution of illegal content based on multiple information libraries as described in any one of claims 1 to 9 when executing the computer program.

12. A computer program product, characterized in that The computer program product includes computer program code, and when the computer program code is executed on a computer, the computer executes the analysis method for checking the distribution of illegal content based on multiple information bases as described in any one of claims 1 to 9.

Images