Domain name resolution link evaluation method and device, computer equipment, storage medium and program product

Abstract

The invention relates to a domain name resolution link evaluation method and device, computer equipment, a storage medium and a program product. The method comprises the following steps: in the process of responding to an analysis request through a local domain name analyzer, obtaining an analysis link of the local domain name analyzer, merging the analysis links of a plurality of local domain name analyzers to obtain an analysis link tree, and for each node in the analysis link tree, scoring the node through a neural network model to obtain an analysis link tree; and performing reliability evaluation on the analysis link according to the scoring result, and updating the scoring result according to the response state of the analysis link. By adopting the method, the reliability of the resolution link can be accurately evaluated, so that the accuracy of domain name resolution is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a domain name resolution link evaluation method, device, computer equipment, storage medium and program product. Background Art

[0002] In the current Internet environment, DNS (Domain Name System) is the core mechanism for converting domain names into IP addresses. The accuracy and credibility of its resolution results are crucial to ensuring the security and stability of network communications. With the increasing complexity of the network environment, especially in cross-regional and multi-CDN (Content Distribution Network) domain name scenarios, the dynamic changes in DNS resolution paths and the inconsistency of resolution results have brought great challenges to the confidence of DNS resolution results.

[0003] In traditional methods, the credibility of the resolution results is mainly verified at the Local DNS (DNS resolution server) level. Through an external blacklist management mechanism, malicious domain names appearing in CNAME (alias record) records or resolved malicious IP addresses are marked and intercepted. Resolution results that are not in the blacklist are considered credible.

[0004] However, in order to maintain the accuracy and timeliness of the blacklist, it is necessary to rely on a large number of security systems, data reporting and other means for continuous updating and maintenance, which not only increases operating costs, but may also lead to security loopholes due to the lag in information updates. Summary of the invention

[0005] Based on this, it is necessary to provide a domain name resolution link evaluation method, device, computer equipment, storage medium and program product that can effectively ensure the accuracy of the resolution results in response to the above technical problems.

[0006] In a first aspect, the present application provides a domain name resolution link evaluation method, comprising:

[0007] In the process of responding to the resolution request through the local domain name resolver, obtaining the resolution link of the local domain name resolver;

[0008] The resolution links of multiple local domain name resolvers are merged to obtain a resolution link tree; the leaf nodes of the resolution link tree are jump nodes in the domain name resolution path, and the trunk and branches of the resolution link tree are used to represent the resolution hierarchical relationship between the jump nodes;

[0009] For each node in the parsing link tree, the node is scored through the neural network model, and the reliability of the parsing link is evaluated based on the scoring results;

[0010] The scoring result is updated according to the response status of the parsing link.

[0011] In one embodiment, the step of obtaining the resolution link of the local domain name resolver includes:

[0012] Get the resolution path of the local domain name resolver; the resolution path includes the domain name jumped from the root server to the target IP address;

[0013] Obtain the resolution link of the local domain name resolver based on all domain names and redirection records in the resolution path.

[0014] In one embodiment, the step of merging the resolution links of multiple local domain name resolvers to obtain a resolution link tree includes:

[0015] Identify common nodes in the resolution links of multiple local domain name resolvers; common nodes are domain names or jump records that appear repeatedly in the resolution link;

[0016] The public node is used as the main trunk of the resolution link tree, and the links after the public node in the resolution link are used as branches of the main trunk to obtain the resolution link tree.

[0017] In one embodiment, the step of scoring the nodes by the neural network model includes:

[0018] The node information of the node is used as the input parameter of the neural network model, and the current trust score of the node is output; the node information includes node type, data source, resolved domain name, IP address corresponding to the resolved domain name, data source IP address, last updated date, response time, number of requests, data integrity, and historical trust score.

[0019] In one embodiment, the step of evaluating the reliability of the resolution link according to the scoring result includes:

[0020] When the current trust score is not less than the trust score threshold, it is determined that the resolution path corresponding to the node is trustworthy;

[0021] When the current trust score is less than the trust score threshold, the node is marked as a suspicious node and a deep verification is performed on the suspicious node.

[0022] In one embodiment, the method further comprises:

[0023] Obtain the update status of the resolution link, and update the resolution link tree according to the update status;

[0024] When it is determined according to the update status that there is a node in a long-term invalid state or an access-prohibited state, the node is deleted from the resolution link tree.

[0025] In a second aspect, the present application also provides a domain name resolution link evaluation device, including:

[0026] A link acquisition module, used to acquire a resolution link of a local domain name resolver in the process of responding to a resolution request through the local domain name resolver;

[0027] A link tree construction module is used to merge the resolution links of multiple local domain name resolvers to obtain a resolution link tree; the leaf nodes of the resolution link tree are jump nodes in the domain name resolution path, and the trunk and branches of the resolution link tree are used to represent the resolution hierarchical relationship between the jump nodes;

[0028] A reliability evaluation module is used to score each node in the parsing link tree through a neural network model and to evaluate the reliability of the parsing link based on the scoring results;

[0029] The scoring update module is used to update the scoring result according to the response status of the parsing link.

[0030] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method steps of any one of the first aspects are implemented.

[0031] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which implements any one of the method steps in the first aspect when the computer program is executed by a processor.

[0032] In a fifth aspect, the present application further provides a computer program product, comprising a computer program, which implements any one of the method steps in the first aspect when executed by a processor.

[0033] The above-mentioned domain name resolution link evaluation method, device, computer equipment, storage medium and program product obtain a resolution link tree by merging the resolution links of multiple local domain name resolvers. Since the leaf nodes of the resolution link tree represent the jump nodes in the domain name resolution path, the reliability of each node can be accurately evaluated through the neural network model, and then the reliability of the resolution link can be accurately evaluated based on the node reliability, thereby improving the accuracy of domain name resolution. In addition, by updating the scoring results through the response status of the resolution link, the real-time and effectiveness of the reliability evaluation of the resolution link can be ensured, and the accuracy of the reliability evaluation of the resolution link can be further improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0035] Figure 1 A diagram of an application environment of a domain name resolution link evaluation method in one embodiment;

[0036] Figure 2 A schematic diagram of a process of a domain name resolution link evaluation method in one embodiment;

[0037] Figure 3 A schematic diagram of a flow chart of a domain name resolution link evaluation method in another embodiment;

[0038] Figure 4 It is a structural block diagram of a domain name resolution link evaluation device in one embodiment;

[0039] Figure 5 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0041] The domain name resolution link evaluation method provided in the embodiment of the present application can be applied to Figure 1In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. Among them, the terminal 102 is used to obtain the resolution link of the local domain name resolver in the process of responding to the resolution request through the local domain name resolver, merge the resolution links of multiple local domain name resolvers, obtain the resolution link tree, and score each node in the resolution link tree through the neural network model. The reliability of the resolution link is evaluated according to the scoring result, and the scoring result is updated according to the response status of the resolution link. Among them, the terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablets, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car devices, projection devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. Head-mounted devices can be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. The server 104 may be, but is not limited to, a domain name server (DNS resolver) or the like.

[0042] In an exemplary embodiment, Figure 2 As shown, a domain name resolution link evaluation method is provided, and the method is applied to Figure 1 The terminal 102 in the example is used as an example to illustrate, including the following steps 202 to 208. Among them:

[0043] S202: In the process of responding to the resolution request through the local domain name resolver, a resolution link of the local domain name resolver is obtained.

[0044] Optionally, for ease of understanding, the following is an explanation of the complete process of the local domain name resolver responding to the resolution request: When a client initiates a resolution request for the IP address corresponding to a domain name, the client first sends a resolution request to the configured local domain name resolver (i.e., the local DNS server). After receiving the request, the local DNS server checks its own cache. If there is no corresponding record in the local DNS server cache, the local DNS server sends a request to the root server according to the hierarchical structure of the global domain name system. After receiving the request, the root server checks the requested top-level domain name and returns the relevant guidance information of the authoritative DNS server responsible for the top-level domain name (usually the IP address of the corresponding top-level domain name server). The local DNS server sends a request to the corresponding top-level domain name server according to the guidance of the root server, requesting to query the authoritative DNS server information corresponding to the current domain name. After receiving the request, the top-level domain name server will find and return the IP address of the authoritative DNS server corresponding to the current domain name. The local DNS server then sends a request to the authoritative DNS server to inquire about the IP address information corresponding to the domain name. After receiving the request, if the domain name is configured with a CNAME record (i.e., the alias of the domain name points to another domain name), it will first return the other domain name pointed to by the CNAME record. After receiving the CNAME record, the local DNS server will repeat the above query to the authoritative DNS server and similar processes for the new domain name, and continue to send requests to the authoritative DNS server. Finally, the authoritative DNS server returns the corresponding IP address for the currently queried domain name. After receiving the final IP address, the local DNS server will cache the domain name to facilitate the rapid response to subsequent query requests for the same domain name. At the same time, the local DNS server will feed back the resolved IP address to the client to complete the entire resolution link.

[0045] Optionally, by obtaining key information such as the time of each stage, the server IP addresses involved, domain name changes, and corresponding operations in the process of the local domain name resolver responding to the resolution request, the resolution link of the local domain name resolver can be completely obtained.

[0046] S204: merging the resolution links of multiple local domain name resolvers to obtain a resolution link tree; the leaf nodes of the resolution link tree are jump nodes in the domain name resolution path, and the trunk and branches of the resolution link tree are used to represent the resolution hierarchical relationship between the jump nodes.

[0047] Optionally, if there are multiple local domain name resolvers, each with its own resolution link, these links can be merged into a resolution link tree to more intuitively display the structure of the entire domain name resolution system. In the resolution link tree, the leaf nodes represent the jump nodes in the domain name resolution path, such as the domain name jump point caused by the CNAME (alias) record, and the trunk and branches reflect the hierarchical relationship between these jump nodes, for example, from the root server to the top-level domain name server, and then to the authoritative domain name server.

[0048] S206: For each node in the parsing link tree, score the node through the neural network model, and evaluate the reliability of the parsing link according to the scoring result.

[0049] Optionally, the neural network model can use a large amount of data to learn the relationship between the characteristics and reliability of each node in the parsing link. For the nodes in the parsing link tree, by scoring the nodes according to the node information, the reliability of each node can be quantified, thereby evaluating the reliability of the parsing link.

[0050] S208: Update the scoring result according to the response status of the parsing link.

[0051] Optionally, since the network environment in which the domain name resolver operates is complex and dynamically changing, the operating status, response capability, etc. of the node may change at any time. By dynamically adjusting the trust score, the current reliability of the node can be more accurately reflected.

[0052] In the above domain name resolution link evaluation method, the resolution link tree is obtained by merging the resolution links of multiple local domain name resolvers. Since the leaf nodes of the resolution link tree represent the jump nodes in the domain name resolution path, the reliability of each node can be accurately evaluated through the neural network model, and then the reliability of the resolution link can be accurately evaluated based on the node reliability, thereby improving the accuracy of domain name resolution. In addition, by updating the scoring results based on the response status of the resolution link, the real-time and effectiveness of the reliability evaluation of the resolution link can be ensured, and the accuracy of the reliability evaluation of the resolution link can be further improved.

[0053] In an exemplary embodiment, the step of obtaining the resolution link of the local domain name resolver includes: obtaining the resolution path of the local domain name resolver; the resolution path includes the domain name jumped from the root server to the target IP address; based on all the domain names and jump records jumped in the resolution path, obtaining the resolution link of the local domain name resolver.

[0054] Optionally, when the local domain name resolver receives a domain name resolution request, it will search for the target IP address according to the hierarchical structure of the Domain Name System (DNS), starting from the root server, to the domain name corresponding to the top-level domain name server, and then to the domain name that is redirected for various reasons (such as alias settings), until the domain name that finally points to the target IP address. These domain names constitute the main body of the resolution path. According to all the domain names and jump records that jump in the resolution path, the resolution link of the local domain name resolver can be obtained, where the resolution link is based on the resolution path, and records each jump step and related information in more detail, including the query time, server response information, etc. in addition to the domain name. For example, every time a domain name server jumps to another domain name server, the time of the jump, the information of the source server and the target server (such as the IP address), whether the query is successful, and the content of the response (such as whether the address of another domain name server or the target IP address is returned) are recorded, and these detailed information are combined together to form a complete resolution link.

[0055] In this embodiment, by obtaining the resolution path of the local domain name resolver and obtaining the resolution link of the local domain name resolver based on all domain names and jump records in the resolution path, the node that needs reliability evaluation can be accurately located, thereby improving the efficiency of reliability evaluation.

[0056] In an exemplary embodiment, the steps of merging the resolution links of multiple local domain name resolvers to obtain a resolution link tree include: identifying common nodes in the resolution links of multiple local domain name resolvers; the common nodes are domain names or jump records that appear repeatedly in the resolution links; using the common nodes as the main trunk of the resolution link tree, and using the links in the resolution links and after the common nodes as branches of the main trunk to obtain the resolution link tree.

[0057] Optionally, when there are multiple resolution links of local domain name resolvers, it is necessary to determine the common nodes therein, wherein the common nodes refer to the parts that appear repeatedly in different resolution links. The common nodes are used as the main trunk of the resolution link tree, and the link parts located after the common nodes in the resolution link are used as branches of the main trunk. The unique path of each local domain name resolver after passing through the common node, such as subsequent operations such as CNAME jumps for specific domain names or connecting to specific authoritative domain name servers, forms a branch connected to the corresponding node on the main trunk.

[0058] In this embodiment, by constructing a resolution link tree, the reliability of the entire domain name resolution system can be evaluated. Since the branches of the resolution link tree represent the unique paths of different local domain name resolvers after passing through the common node, the reliability of different branches can be evaluated separately, thereby ensuring the accuracy of the reliability evaluation.

[0059] In an exemplary embodiment, the step of scoring nodes through a neural network model includes: using the node information of the node as an input parameter of the neural network model, and outputting the current trust score of the node; the node information includes the node type, data source, resolved domain name, IP address corresponding to the resolved domain name, data source IP address, last updated date, response time, number of requests, data integrity, and historical trust score.

[0060] Optionally, the input parameter of the neural network model is node information, wherein the node information includes node type, data source, resolved domain name, IP address corresponding to the resolved domain name, data source IP address, last updated date, response time, number of requests, data integrity, and historical trustworthy score, etc. It should be noted that if the node does not have a historical trustworthy score, the default score is 0. The input node information is operated and learned through the neural network model, and the current trustworthy score of the node is calculated and output.

[0061] For example, a neural network is taken as a Long Short-Term Memory (LSTM) network. The input data of the LSTM is the node information, and the output is the current trust score of the node. For each node in the parsed link tree, the node information is as shown in Table 1:

[0062] Table 1

[0063]

[0064] It should be noted that the node information shown in the table is sample information collected once, and the LSTM model can learn the long-term and short-term dependencies of time series data, and will continuously accumulate node information during the iterative processing.

[0065] In this embodiment, scoring nodes through a neural network model can integrate a variety of node information, avoiding the one-sidedness that may be caused by a single factor evaluation. In addition, the neural network model can capture the temporal dependency of node information, thereby improving the accuracy of the scoring.

[0066] In an exemplary embodiment, the step of performing reliability assessment on the resolution link according to the scoring result includes: when the current trust score is not less than the trust score threshold, determining that the resolution path corresponding to the node is trustworthy; when the current trust score is less than the trust score threshold, marking the node as a suspicious node and performing a deep verification on the suspicious node.

[0067] Optionally, the credibility of the node is evaluated first by the set credibility score threshold. When the current credibility score of the node is not less than this threshold, the resolution path corresponding to the node is considered to be credible. When the current credibility score of the node is less than the credibility score threshold, the node is marked as a suspicious node, indicating that the node may have some problems, such as performance degradation, inaccurate data, or potential security risks. For these suspicious nodes, deep verification is required. Among them, deep verification can be manually verified, for example, managing the domain names in the resolution through a pre-set blacklist, or passing the node information to an external professional security system, and using the functions and resources of these external systems to further verify the reliability of the node.

[0068] In this embodiment, by setting the trust score threshold, it is possible to quickly determine whether a node is trustworthy, thereby improving the efficiency of link analysis evaluation. In addition, by performing in-depth verification on suspicious nodes, the accuracy of link analysis evaluation can be improved.

[0069] In an exemplary embodiment, the method further includes: obtaining an update status of the resolution link, and updating the resolution link tree according to the update status; if it is determined according to the update status that a node is in a long-term invalid state or a prohibited access state, deleting the node from the resolution link tree.

[0070] Optionally, since the state of the resolution link changes dynamically, for example, when a node changes, the resolution link tree needs to be updated accordingly. In the process of monitoring the update status, it may be found that some nodes are in a long-term invalid state (such as a server failure and cannot be restored) or a prohibited access state (perhaps due to restricted access for security reasons). For these nodes, since they can no longer participate in the domain name resolution process normally and may have a negative impact on the reliability of the resolution link, they need to be deleted from the resolution link tree to ensure the reliability of the entire resolution link tree.

[0071] In this embodiment, by timely updating the resolution link tree, the actual resolution link status can be accurately reflected. By removing nodes that have been invalid or prohibited from access for a long time, the resolution link tree can be managed in real time to ensure the validity of the resolution link tree, thereby improving the accuracy of the resolution link evaluation.

[0072] In an exemplary embodiment, Figure 3 As shown, a domain name resolution link evaluation method is provided, the method comprising the following steps:

[0073] In the process of responding to the resolution request through the local domain name resolver, the resolution path of the local domain name resolver is obtained; the resolution path includes the domain name jumped from the root server to the target IP address; based on all the domain names and jump records jumped in the resolution path, the resolution link of the local domain name resolver is obtained.

[0074] Identify the common nodes in the resolution links of multiple local domain name resolvers; the common nodes are domain names or jump records that appear repeatedly in the resolution links; use the common nodes as the main trunk of the resolution link tree, and use the links after the common nodes in the resolution link as branches of the main trunk to obtain a resolution link tree. The leaf nodes of the resolution link tree are jump nodes in the domain name resolution path, and the trunk and branches of the resolution link tree are used to represent the resolution hierarchical relationship between jump nodes.

[0075] For each node in the resolution link tree, the node information is used as the input parameter of the neural network model, and the current trust score of the node is output. The node information includes node type, data source, resolution domain name, IP address corresponding to the resolution domain name, data source IP address, last update date, response time, number of requests, data integrity, and historical trust score.

[0076] When the current trust score is not less than the trust score threshold, the resolution path corresponding to the node is determined to be trustworthy; when the current trust score is less than the trust score threshold, the node is marked as a suspicious node and a deep verification is performed on the suspicious node.

[0077] The scoring result is updated according to the response status of the parsing link.

[0078] The update status of the resolution link is obtained, and the resolution link tree is updated according to the update status; if it is determined according to the update status that there is a node in a long-term invalid state or a prohibited access state, the node is deleted from the resolution link tree.

[0079] In this embodiment, a resolution link tree is obtained by merging the resolution links of multiple local domain name resolvers. Since the leaf nodes of the resolution link tree represent the jump nodes in the domain name resolution path, the reliability of each node can be accurately evaluated through the neural network model, and then the reliability of the resolution link can be accurately evaluated according to the node reliability, thereby improving the accuracy of domain name resolution. In addition, by updating the scoring results based on the response status of the resolution link, the real-time and effectiveness of the reliability evaluation of the resolution link can be ensured, and the accuracy of the reliability evaluation of the resolution link can be further improved.

[0080] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0081] Based on the same inventive concept, the embodiment of the present application also provides a domain name resolution link evaluation device for implementing the domain name resolution link evaluation method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more domain name resolution link evaluation device embodiments provided below can refer to the limitations of the domain name resolution link evaluation method above, and will not be repeated here.

[0082] In an exemplary embodiment, Figure 4 As shown, a domain name resolution link evaluation device is provided, comprising: a link acquisition module 10, a link tree construction module 20, a reliability evaluation module 30 and a score update module 40, wherein:

[0083] The link acquisition module 10 is used to acquire the resolution link of the local domain name resolver in the process of responding to the resolution request through the local domain name resolver.

[0084] The link tree construction module 20 is used to merge the resolution links of multiple local domain name resolvers to obtain a resolution link tree; the leaf nodes of the resolution link tree are jump nodes in the domain name resolution path, and the trunk and branches of the resolution link tree are used to represent the resolution hierarchical relationship between the jump nodes.

[0085] The reliability evaluation module 30 is used to score each node in the parsed link tree through a neural network model, and to perform reliability evaluation on the parsed link according to the scoring result.

[0086] The scoring update module 40 is used to update the scoring result according to the response status of the parsing link.

[0087] In an exemplary embodiment, the link acquisition module 10 is also used to obtain the resolution path of the local domain name resolver; the resolution path includes the domain name jumped from the root server to the target IP address; based on all the domain names and jump records jumped in the resolution path, the resolution link of the local domain name resolver is obtained.

[0088] In an exemplary embodiment, the link tree construction module 20 is also used to identify common nodes in the resolution links of multiple local domain name resolvers; the common nodes are domain names or jump records that appear repeatedly in the resolution links; the common nodes are used as the main trunk of the resolution link tree, and the links in the resolution link and after the common nodes are used as branches of the main trunk to obtain the resolution link tree.

[0089] In an exemplary embodiment, the reliability assessment module 30 is also used to use the node information of the node as an input parameter of the neural network model, and output the current trust score of the node; the node information includes node type, data source, resolved domain name, IP address corresponding to the resolved domain name, data source IP address, last updated date, response time, number of requests, data integrity, and historical trust score.

[0090] In an exemplary embodiment, the reliability assessment module 30 is also used to determine that the resolution path corresponding to the node is trustworthy when the current trust score is not less than the trust score threshold; when the current trust score is less than the trust score threshold, mark the node as a suspicious node and perform a deep check on the suspicious node.

[0091] In an exemplary embodiment, the score update module 40 is also used to obtain the update status of the resolution link and update the resolution link tree according to the update status; if it is determined according to the update status that a node is in a long-term invalid state or a prohibited access state, the node is deleted from the resolution link tree.

[0092] Each module in the above-mentioned domain name resolution link evaluation device can be implemented in whole or in part by software, hardware and a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0093] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 5As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, a domain name resolution link evaluation method is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0094] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0095] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the following steps when executing the computer program: in the process of responding to a resolution request through a local domain name resolver, obtaining a resolution link of the local domain name resolver; merging the resolution links of multiple local domain name resolvers to obtain a resolution link tree; the leaf nodes of the resolution link tree are jump nodes in the domain name resolution path, and the trunk and branches of the resolution link tree are used to represent the resolution hierarchical relationship between the jump nodes; for each node in the resolution link tree, scoring the node through a neural network model, and evaluating the reliability of the resolution link according to the scoring result; and updating the scoring result according to the response status of the resolution link.

[0096] In one embodiment, the process of obtaining a resolution link of a local domain name resolver when executing a computer program includes: obtaining a resolution path of the local domain name resolver; the resolution path includes a domain name jumped from a root server to a target IP address; and obtaining a resolution link of the local domain name resolver based on all domain names and jump records jumped in the resolution path.

[0097] In one embodiment, when a processor executes a computer program, the resolution links of multiple local domain name resolvers are merged to obtain a resolution link tree, including: identifying common nodes in the resolution links of multiple local domain name resolvers; the common nodes are domain names or jump records that appear repeatedly in the resolution links; the common nodes are used as the main trunk of the resolution link tree, and the links in the resolution link and after the common nodes are used as branches of the main trunk to obtain the resolution link tree.

[0098] In one embodiment, the scoring of nodes through a neural network model involved in executing a computer program by a processor includes: using the node information of the node as an input parameter of the neural network model, and outputting the current trust score of the node; the node information includes the node type, data source, resolved domain name, IP address corresponding to the resolved domain name, data source IP address, last updated date, response time, number of requests, data integrity, and historical trust score.

[0099] In one embodiment, the reliability assessment of the resolution link according to the scoring result involved in the execution of the computer program by the processor includes: when the current trust score is not less than the trust score threshold, determining that the resolution path corresponding to the node is trustworthy; when the current trust score is less than the trust score threshold, marking the node as a suspicious node and performing a deep verification on the suspicious node.

[0100] In one embodiment, when the processor executes the computer program, the following steps are also implemented: obtaining the update status of the resolution link, and updating the resolution link tree according to the update status; if it is determined according to the update status that there is a node in a long-term invalid state or a prohibited access state, the node is deleted from the resolution link tree.

[0101] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented: in the process of responding to a resolution request through a local domain name resolver, a resolution link of the local domain name resolver is obtained; the resolution links of multiple local domain name resolvers are merged to obtain a resolution link tree; the leaf nodes of the resolution link tree are jump nodes in the domain name resolution path, and the trunk and branches of the resolution link tree are used to represent the resolution hierarchical relationship between the jump nodes; for each node in the resolution link tree, the node is scored through a neural network model, and the reliability of the resolution link is evaluated according to the scoring result; according to the response status of the resolution link, the scoring result is updated.

[0102] In one embodiment, the steps of obtaining the resolution link of the local domain name resolver when the computer program is executed by the processor include: obtaining the resolution path of the local domain name resolver; the resolution path includes the domain name jumped from the root server to the target IP address; and obtaining the resolution link of the local domain name resolver based on all the domain names and jump records jumped in the resolution path.

[0103] In one embodiment, when a computer program is executed by a processor, it involves merging the resolution links of multiple local domain name resolvers to obtain a resolution link tree, including: identifying common nodes in the resolution links of multiple local domain name resolvers; the common nodes are domain names or jump records that appear repeatedly in the resolution links; using the common nodes as the main trunk of the resolution link tree, and using the links in the resolution link and after the common nodes as branches of the main trunk to obtain the resolution link tree.

[0104] In one embodiment, when a computer program is executed by a processor, it involves scoring nodes through a neural network model, including: using the node information of the node as an input parameter of the neural network model, and outputting the current trust score of the node; the node information includes the node type, data source, resolved domain name, IP address corresponding to the resolved domain name, data source IP address, last updated date, response time, number of requests, data integrity, and historical trust score.

[0105] In one embodiment, the computer program executed by the processor involves performing reliability assessment on the resolution link according to the scoring result, including: when the current trust score is not less than the trust score threshold, determining that the resolution path corresponding to the node is trustworthy; when the current trust score is less than the trust score threshold, marking the node as a suspicious node and performing a deep verification on the suspicious node.

[0106] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: obtaining the update status of the resolution link, and updating the resolution link tree according to the update status; if it is determined according to the update status that there is a node in a long-term invalid state or a prohibited access state, deleting the node from the resolution link tree.

[0107] In one embodiment, a computer program product is provided, including a computer program, which implements the following steps when executed by a processor: in the process of responding to a resolution request through a local domain name resolver, obtaining a resolution link of the local domain name resolver; merging the resolution links of multiple local domain name resolvers to obtain a resolution link tree; the leaf nodes of the resolution link tree are jump nodes in the domain name resolution path, and the trunk and branches of the resolution link tree are used to represent the resolution hierarchical relationship between the jump nodes; for each node in the resolution link tree, scoring the node through a neural network model, and evaluating the reliability of the resolution link according to the scoring result; and updating the scoring result according to the response status of the resolution link.

[0108] In one embodiment, the steps of obtaining the resolution link of the local domain name resolver when the computer program is executed by the processor include: obtaining the resolution path of the local domain name resolver; the resolution path includes the domain name jumped from the root server to the target IP address; and obtaining the resolution link of the local domain name resolver based on all the domain names and jump records jumped in the resolution path.

[0109] In one embodiment, when a computer program is executed by a processor, it involves merging the resolution links of multiple local domain name resolvers to obtain a resolution link tree, including: identifying common nodes in the resolution links of multiple local domain name resolvers; the common nodes are domain names or jump records that appear repeatedly in the resolution links; using the common nodes as the main trunk of the resolution link tree, and using the links in the resolution link and after the common nodes as branches of the main trunk to obtain the resolution link tree.

[0110] In one embodiment, when a computer program is executed by a processor, it involves scoring nodes through a neural network model, including: using the node information of the node as an input parameter of the neural network model, and outputting the current trust score of the node; the node information includes the node type, data source, resolved domain name, IP address corresponding to the resolved domain name, data source IP address, last updated date, response time, number of requests, data integrity, and historical trust score.

[0111] In one embodiment, the computer program executed by the processor involves performing reliability assessment on the resolution link according to the scoring result, including: when the current trust score is not less than the trust score threshold, determining that the resolution path corresponding to the node is trustworthy; when the current trust score is less than the trust score threshold, marking the node as a suspicious node and performing a deep verification on the suspicious node.

[0112] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: obtaining the update status of the resolution link, and updating the resolution link tree according to the update status; if it is determined according to the update status that there is a node in a long-term invalid state or a prohibited access state, deleting the node from the resolution link tree.

[0113] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0114] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0115] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A domain name resolution link evaluation method, characterized in that: The method comprises: In the process of responding to the resolution request through the local domain name resolver, obtaining the resolution link of the local domain name resolver; Merging the resolution links of multiple local domain name resolvers to obtain a resolution link tree; the leaf nodes of the resolution link tree are jump nodes in the domain name resolution path, and the trunk and branches of the resolution link tree are used to represent the resolution hierarchical relationship between the jump nodes; For each node in the parsing link tree, the node is scored by a neural network model, and the reliability of the parsing link is evaluated according to the scoring result; The scoring result is updated according to the response status of the parsing link.

2. The method according to claim 1, characterized in that The obtaining the resolution link of the local domain name resolver includes: Obtaining a resolution path of the local domain name resolver; the resolution path includes a domain name jumped from a root server to a target IP address; According to all domain names and jump records jumped in the resolution path, the resolution link of the local domain name resolver is obtained.

3. The method according to claim 2, characterized in that The merging of the resolution links of the multiple local domain name resolvers to obtain a resolution link tree includes: Identify a common node in a resolution link of multiple local domain name resolvers; the common node is a domain name or jump record that appears repeatedly in the resolution link; The public node is used as the main trunk of the resolution link tree, and the links after the public node in the resolution link are used as branches of the main trunk to obtain the resolution link tree.

4. The method according to claim 3, characterized in that The step of scoring the nodes by using a neural network model comprises: The node information of the node is used as an input parameter of the neural network model, and the current trust score of the node is output; the node information includes node type, data source, resolved domain name, IP address corresponding to the resolved domain name, data source IP address, last updated date, response time, number of requests, data integrity, and historical trust score.

5. The method according to claim 4, characterized in that The performing reliability evaluation on the resolution link according to the scoring result includes: When the current trust score is not less than a trust score threshold, determining that the resolution path corresponding to the node is trustworthy; When the current trust score is less than the trust score threshold, the node is marked as a suspicious node, and a deep verification is performed on the suspicious node.

6. The method according to claim 1, characterized in that The method further comprises: Acquire the update status of the resolution link, and update the resolution link tree according to the update status; When it is determined according to the update status that there is a node in a long-term invalid state or an access-prohibited state, the node is deleted from the resolution link tree.

7. A domain name resolution link evaluation device, characterized in that: The device comprises: A link acquisition module, used to acquire a resolution link of the local domain name resolver in the process of responding to a resolution request through the local domain name resolver; A link tree construction module is used to merge the resolution links of multiple local domain name resolvers to obtain a resolution link tree; the leaf nodes of the resolution link tree are jump nodes in the domain name resolution path, and the trunk and branches of the resolution link tree are used to represent the resolution hierarchical relationship between the jump nodes; A reliability evaluation module, used for scoring each node in the parsing link tree through a neural network model, and performing reliability evaluation on the parsing link according to the scoring result; The scoring update module is used to update the scoring result according to the response status of the analysis link.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images