Domain name information management method, storage medium, electronic equipment and product

Abstract

The invention relates to the technical field of network security, and particularly provides a domain name information management method, a storage medium, electronic equipment and a product, and the method comprises the steps: traversing a domain name cache data table, and determining that domain name information of each domain name node exists in a database and domain name access time does not exceed a first threshold value; reading an IP cache data table in each domain name node; traversing the IP cache data table, determining the latest request information of each IP node, and deleting the IP nodes of which the IP node access time exceeds a second threshold value to obtain a latest domain name cache data table and a latest IP cache data table; a plurality of domain name index values and domain name nodes cached under each domain name index value are cached in the domain name cache data table; a plurality of IP index values and IP nodes cached under each IP index value are cached in the IP cache data table. According to the embodiment of the invention, the occupation of domain name cache information on equipment memory can be reduced, and the consumption of equipment performance is reduced.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, storage medium, electronic device and product for domain name information management. Background Art

[0002] DNS (Domain Name System) is an important basic service of the Internet. It is the basis for the safe and reliable operation of almost all applications. Statistics on DNS access information are an important step in dealing with DNS security issues. The DNS information obtained by statistics can be used as a data analysis source for the protection module, and can also be used to discover potential attack behaviors. At present, in the domain name information monitoring scheme of the prior art, the obtained DNS information is placed in the message queue for cache and directly used for subsequent analysis and processing. However, when the amount of DNS access data is large, the message cache queue will occupy a large amount of device memory, and the efficiency of traversing the message cache queue during data processing is also low.

[0003] Therefore, how to provide a technical solution for an efficient domain name information management method has become a technical problem that needs to be solved urgently. Summary of the invention

[0004] The purpose of some embodiments of the present application is to provide a method, storage medium, electronic device and product for domain name information management. The technical solutions of the embodiments of the present application can reduce the occupancy of device memory by domain name cache information, reduce the impact on device performance, and improve the query efficiency of domain name ring information.

[0005] In a first aspect, some embodiments of the present application provide a method for managing domain name information, including: traversing a domain name cache data table, confirming that the domain name information of each domain name node exists in a database and that the domain name access time does not exceed a first threshold, and then reading an IP cache data table in each domain name node; traversing the IP cache data table, determining the latest request information of each IP node, and deleting IP nodes whose IP node access time exceeds a second threshold, to obtain the latest domain name cache data table and the latest IP cache data table; wherein the domain name cache data table caches a plurality of domain name index values ​​and the domain name nodes cached under each domain name index value; and the IP cache data table caches a plurality of IP index values ​​and the IP nodes cached under each IP index value.

[0006] Some embodiments of the present application traverse the domain name cache data table, determine each domain name node that meets the conditions, and then traverse the IP cache data table in each domain name node to determine the latest request information of each IP node and generate a timeout IP node, thereby obtaining the latest domain name cache data table and the latest IP cache data table; wherein, the domain name cache data table and the IP cache data table are stored in the form of index values, thereby improving the query efficiency of the data. Moreover, by traversing the data table and deleting the timeout data, the occupation of the device memory by the domain name cache information can be reduced, and the impact on the device performance can be reduced.

[0007] In some embodiments, before confirming that the domain name information of each domain name node exists in the database, the method also includes: if it is confirmed that any domain name node is cached in the database for the first time, recording the domain name information of any domain name node in the domain name information table, wherein the domain name information of any domain name node includes: domain name, domain name summary value and other related information.

[0008] Some embodiments of the present application record any domain name node by confirming that any domain name node is stored in the database for the first time, so as to facilitate subsequent processing and analysis of any domain name node.

[0009] In some embodiments, the method further includes: deleting, from the domain name cache data table, domain name nodes whose domain name access time exceeds the first threshold.

[0010] Some embodiments of the present application reduce the occupancy of device memory by domain name cache data by deleting domain name nodes with timed-out domain name access.

[0011] In some embodiments, determining the latest request information of each IP node includes: if the current request information and current storage information of each IP node are consistent, confirming the current storage information as the latest request information, and retaining the IP nodes whose IP access time does not exceed the second threshold; if it is confirmed that the current request information and the current storage information are inconsistent, updating the current storage information to the current request information, and the current request information is the latest request information.

[0012] Some embodiments of the present application determine the latest request information of each IP node by confirming whether the current request information of each IP node is consistent with the current storage information, thereby achieving timely update of data.

[0013] In some embodiments, the domain name cache data table is obtained by the following method: calculating the domain name information of the acquired target domain name node to obtain the target domain name index value corresponding to the target domain name node; based on the target domain name index value, confirming whether the target domain name node exists in the domain name cache data table, and recording the target domain name information and target domain name access time of the target domain name node.

[0014] Some embodiments of the present application confirm whether the domain name cache data table stores the target domain name node by calculating the domain name index value obtained after obtaining the domain name information of the target domain name node, and record the relevant information of the target domain name node, and cache the latest information of the target domain name node in time.

[0015] In some embodiments, based on the target domain name index value, confirming whether the target domain name node exists in the domain name cache data table, and recording the target domain name information and the target domain name access time of the target domain name node, includes: if it is confirmed that the target domain name node exists in the domain name cache data table, updating the target domain name access time; if it is confirmed that the target domain name node does not exist in the domain name cache data table, adding the target domain name node, and adding the target domain name information and the target domain name access time.

[0016] Some embodiments of the present application update relevant information when confirming that the target domain name node exists in the domain name cache data table, and record relevant information when confirming that the target domain name node does not exist in the domain name cache data table, thereby achieving timely caching of the target domain name node.

[0017] In some embodiments, after recording the target domain name information and the target domain name access time of the target domain name node, the method further includes: confirming whether there is a target IP node in the IP cache data table in the target domain name node, and recording the IP request information of the target IP node, wherein the IP request information includes the IP access time and the number of IP accesses.

[0018] Some embodiments of the present application implement timely caching of the target IP node by confirming whether the target IP node exists in the IP cache data table and recording relevant information of the target IP node.

[0019] In some embodiments, the confirming whether the target IP node exists in the IP cache data table in the target domain name node and recording the IP request information of the target IP node includes: calculating the source IP request to obtain a source IP index value; when the corresponding target IP node is found in the IP cache data table through the source IP index value, updating the IP request information; when the corresponding target IP node is not found in the IP cache data table through the IP index value, adding the target IP node and the IP request information.

[0020] Some embodiments of the present application use the IP index value corresponding to the source IP request to search in the IP cache data table to see whether the target IP node exists, and obtain the latest information of the target IP node in a timely manner, thereby achieving timely caching and updating of the target IP node information.

[0021] In a second aspect, some embodiments of the present application provide a device for managing domain name information, comprising: a first management module, used to traverse a domain name cache data table, and when confirming that the domain name information of each domain name node exists in the database and the domain name access time does not exceed a first threshold, read the IP cache data table in each domain name node; a second management module, used to traverse the IP cache data table, determine the latest request information of each IP node, and delete the IP nodes whose IP node access time exceeds a second threshold, to obtain the latest domain name cache data table and the latest IP cache data table; wherein, the domain name cache data table caches multiple domain name index values ​​and the domain name nodes cached under each domain name index value; the IP cache data table caches multiple IP index values ​​and the IP nodes cached under each IP index value.

[0022] In a third aspect, some embodiments of the present application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the method described in any embodiment of the first aspect.

[0023] In a fourth aspect, some embodiments of the present application provide an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor can implement a method as described in any embodiment of the first aspect when executing the program.

[0024] In a fifth aspect, some embodiments of the present application provide a computer program product, wherein the computer program product comprises a computer program, wherein the computer program, when executed by a processor, can implement the method described in any embodiment of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the technical solutions of some embodiments of the present application, the drawings required for use in some embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0026] Figure 1 A system diagram of domain name information management provided for some embodiments of the present application;

[0027] Figure 2 One of the flow charts of the method for caching domain name data provided in some embodiments of the present application;

[0028] Figure 3 A schematic diagram of a cache data structure provided for some embodiments of the present application;

[0029] Figure 4 One of the flow charts of the method for managing domain name information provided in some embodiments of the present application;

[0030] Figure 5 A second flowchart of a method for caching domain name data provided in some embodiments of the present application;

[0031] Figure 6 A second flowchart of a method for managing domain name information provided in some embodiments of the present application;

[0032] Figure 7 A schematic diagram of domain name information management provided for some embodiments of the present application;

[0033] Figure 8 A block diagram of a device for managing domain name information provided in some embodiments of the present application;

[0034] Fig. 9 A schematic diagram of an electronic device is provided for some embodiments of the present application. DETAILED DESCRIPTION

[0035] The technical solutions in some embodiments of the present application will be described below in conjunction with the drawings in some embodiments of the present application.

[0036] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0037] In the related technology, DNS belongs to the infrastructure of Internet infrastructure. Due to its unique position, DNS is also an important target of network attacks. For example, attackers will send a large number of DNS request information to find system vulnerabilities, or users will frequently visit known malicious websites to cause security risks. Network administrators can configure corresponding protection strategies in time based on the information reflected by DNS access statistics to prevent attack behaviors. At present, the methods of DNS statistics include direct caching to the message queue; or recording all DNS logs on the device, reading all DNS logs within an hour every hour, analyzing and obtaining statistical data and storing them in the database. However, when the amount of DNS access data is large, the message queue cache will occupy a large amount of device memory, and the efficiency of traversing the message queue to obtain data during data processing is also low. For scenarios where data needs to be entered into the database, reading directly from the message queue into the database will result in frequent data entry, affecting device performance; while by recording logs, the frequency of data entry is too low, and the DNS request situation cannot be reflected in real time, and recording all DNS logs will consume device performance and occupy a large amount of device memory.

[0038] It can be seen from the above related technologies that in the prior art, the DNS cache occupies a large amount of device memory and has a great impact on device performance.

[0039] In view of this, some embodiments of the present application provide a method for domain name information management, in which a domain name cache data table and an IP cache data table are used when caching domain name nodes and IP nodes. The data table contains index values ​​corresponding to each node, and the corresponding domain name nodes and IP nodes can be quickly retrieved through the index values; then the domain name cache data table and the IP cache data table are traversed, information is updated in a timely manner, and access timeout data is deleted, thereby reducing the occupancy of cached data on device memory and reducing the consumption of device performance by data warehousing, and the method is highly practical.

[0040] The following is combined with Figure 1 The overall structure of the domain name information management system provided by some embodiments of the present application is exemplified.

[0041] like Figure 1As shown, some embodiments of the present application provide a system for domain name information management, which includes: a terminal 100, an application system 200 and a server 300. Among them, when the terminal 100 accesses the server 300, the application system 200 can obtain the information of the target domain name node of the terminal IP request, cache the target domain name node in the domain name cache data table, and cache the corresponding target IP node in the IP cache data table. Then, the stored domain name cache data table and IP cache data table are traversed regularly, the relevant information is updated and the node data with access timeout is deleted in time, which can reduce the frequency of adding new cache information nodes, and cache in the form of a data table to reduce the number of data storage times, thereby reducing the consumption of device performance; the data is cached after the data table after integration and recycled after timeout, which can reduce the consumption of device memory.

[0042] In some embodiments of the present application, the application system 200 may be a firewall system or other systems accessed using domain names, which are not specifically limited in the embodiments of the present application. The terminal 100 may be a mobile terminal or a non-portable computer terminal, which are not specifically limited in the embodiments of the present application.

[0043] It is understandable that cache data is stored in two data tables: domain name cache data table and IP cache data table. Before the cache data enters the database, the domain name node and IP node need to be cached first. Figure 2 The implementation process of domain name data caching performed by the application system 200 provided in some embodiments of the present application is exemplified.

[0044] In some embodiments of the present application, the data structure of cached DNS data (that is, domain name data) is as follows: Figure 3 As shown, Figure 3 The table includes a domain name hash table (as a specific example of a domain name cache data table) and an IP hash table (as a specific example of an IP cache data table). The hash value in the domain name hash table and the hash value of the header in the IP hash table are used as a specific example of a domain name index value and an IP index value. Among them, the header hash values ​​of the domain name hash table and the IP hash table exist from the beginning of table creation. It should be understood that in addition to using a hash algorithm to calculate the index value, other related algorithms can also be used, and the embodiments of the present application are not limited to this.

[0045] Specifically, when caching DNS data, after obtaining the DNS data, a hash value is calculated based on the domain name, and the linked list in the corresponding hash node is found in the domain name hash table through the hash value, and then the node record information with the same domain name is searched on the linked list. Then, a hash value is calculated based on the source IP in the data packet, and the linked list in the corresponding hash node is found in the IP hash table in the domain name node through the hash value, and then the node record information with the same IP is searched on the linked list.

[0046] Please see attached Figure 2 , Figure 2 A flow chart of a method for caching domain name data is provided for some embodiments of the present application. The method for caching domain name data may include:

[0047] S210, calculating the acquired domain name information of the target domain name node to obtain a target domain name index value corresponding to the target domain name node.

[0048] For example, in some embodiments of the present application, a hash calculation is performed on the domain name information of the target domain name node to obtain a domain name hash value (as a specific example of a target domain name index value).

[0049] S220: Based on the target domain name index value, confirm whether the target domain name node exists in the domain name cache data table, and record the target domain name information and the target domain name access time of the target domain name node.

[0050] For example, in some embodiments of the present application, the domain name hash value is used to search the header hash value in the domain name hash table to find the corresponding target domain name node. Regardless of whether the target domain name node is found, the latest target domain name information and target domain name access time of the target domain name node need to be recorded.

[0051] In some embodiments of the present application, S220 may include: if it is confirmed that the target domain name node exists in the domain name cache data table, updating the target domain name access time; if it is confirmed that the target domain name node does not exist in the domain name cache data table, adding the target domain name node, and adding the target domain name information and the target domain name access time.

[0052] For example, in some embodiments of the present application, if the target domain name node is not found in the domain name hash table, the new target domain name node is added to the linked list of the domain name hash table, and the DNS information (as a specific example of the target domain name information) and the target domain name access time are recorded. If the target domain name node can be found, the DNS information is updated on the node, and the target domain name access time is updated this time.

[0053] S230, confirm whether there is a target IP node in the IP cache data table in the target domain name node, and record the IP request information of the target IP node, wherein the IP request information includes the IP access time and the IP access count.

[0054] For example, in some embodiments of the present application, it is necessary to confirm whether the target IP node in the DNS data exists in the IP hash table, and whether it exists or not, the IP request information of the target IP node needs to be recorded in a timely manner.

[0055] In some embodiments of the present application, S230 may include: calculating the source IP request to obtain a source IP index value; when the corresponding target IP node is found in the IP cache data table through the source IP index value, updating the IP request information; when the corresponding target IP node is not found in the IP cache data table through the IP index value, adding the target IP node and the IP request information.

[0056] For example, in some embodiments of the present application, a hash calculation is performed on the source IP in the DNS data packet to obtain an IP hash value (as a specific example of an IP index value). According to the IP hash value, the corresponding target IP node is searched in the header hash value of the IP hash table of the above-mentioned target domain name node. If the target IP node is not found, a new target IP node is added to the linked list of the IP hash table, and the target IP node and the number of visits are recorded (as a specific example of the number of IP visits), and the IP access time is recorded. If the target IP node can be found, the number of visits is increased on the node, and the IP access time is updated.

[0057] It can be seen from the above-mentioned method of caching data that, the domain name cache data table caches multiple domain name index values ​​(i.e., the header hash value when caching the domain name above) and the domain name nodes cached under each domain name index value; the IP hash table caches multiple IP index values ​​(i.e., the header hash value when caching the IP above) and the IP nodes cached under each IP index value.

[0058] When the DNS data is cached and stored in the database, the cached data is stored in two tables: the domain name information table and the IP request domain name table. Later, the domain name hash table and the IP hash table need to be traversed regularly and stored in the domain name information table and the IP request domain name table, as well as the timeout cache node needs to be recovered. Among them, the domain name information table stores the domain name node, domain name MD5 (as a specific example of the domain name summary value) and other domain name related information; the IP request domain name table records the IP access time, domain name MD5, IP node, number of requests, etc. When querying data, you can query the table based on the domain name MD5 field, that is, you can query the specific number of requests for the IP node under a certain domain name. Among them, the domain name MD5 is calculated when the domain name node enters the database.

[0059] The following is combined with Figure 4 The specific process of domain name information management provided by some embodiments of the present application is exemplified.

[0060] Please see attached Figure 4 , Figure 4 A flowchart of a method for managing domain name information performed by an application system 200 is provided for some embodiments of the present application. The method for managing domain name information may include:

[0061] S410, traverse the domain name cache data table, and when it is confirmed that the domain name information of each domain name node exists in the database and the domain name access time does not exceed the first threshold, read the IP cache data table in each domain name node.

[0062] For example, in some embodiments of the present application, a domain name hash table (as a specific example of a domain name cache data table) is traversed according to a set period (for example, 5 seconds), relevant information of the domain name nodes in the domain name hash table is read, and after determining that each domain name node has been stored and the latest domain name access time does not exceed a first threshold, an IP hash table (as a specific example of an IP cache data table) in each domain name node is read.

[0063] In some embodiments of the present application, S410 may include: if it is confirmed that any domain name node is cached in the database for the first time, the domain name information of any domain name node is recorded in the domain name information table, wherein the domain name information of any domain name node includes: domain name, domain name summary value and other related information.

[0064] For example, in some embodiments of the present application, if the information of any domain name node belongs to the first entry into the database, the domain name (that is, any domain name node), domain name MD5 (as a specific example of a domain name summary value) and other domain name related information (as a specific example of other associated information) are recorded in the domain name information table of the database according to the information in any domain name node. Afterwards, it is recorded in the node that the initial entry into the database has been completed. It is understandable that the access time of any domain name node that is entered into the database for the first time must not have timed out. At this time, it can be assumed that it has not timed out (no timeout judgment is required), and the IP hash table in the domain name node is directly read.

[0065] In some embodiments of the present application, S410 may include: deleting, from the domain name cache data table, domain name nodes whose domain name access time exceeds the first threshold.

[0066] For example, in some embodiments of the present application, if the information in the domain name node already exists in the database and is not stored for the first time, then check whether the last access time recorded in the domain name node has timed out (i.e., whether it exceeds the first threshold). If it has timed out, then delete the domain name node and the information related to it. Then continue to process the next domain name node. Among them, the value of the first threshold can be flexibly set, and the embodiments of the present application are not specifically limited here.

[0067] S420, traverse the IP cache data table to determine the latest request information of each IP node, and delete the IP nodes whose access time exceeds the second threshold, to obtain the latest domain name cache data table and the latest IP cache data table.

[0068] For example, in some embodiments of the present application, when the domain name node has not timed out or the domain name node information is first stored in the database, the IP nodes in the IP hash table in the domain name node are traversed to determine the latest request information of each IP node, and the nodes whose IP node access time has timed out (i.e., the access time exceeds the second threshold) are deleted. The latest domain name hash table (as a specific example of the latest domain name cache data table) and the latest IP hash table (as a specific example of the latest IP cache data table) can be obtained through the implementation process of S410 to S420.

[0069] In some embodiments of the present application, S420 may include: if the current request information and the current storage information of each IP node are consistent, confirming that the current storage information is the latest request information, and retaining the IP nodes whose IP access time does not exceed the second threshold; if it is confirmed that the current request information and the current storage information are inconsistent, updating the current storage information to the current request information, and the current request information is the latest request information.

[0070] For example, in some embodiments of the present application, the "current number of requests" in the IP node records the total number of requests for this domain name by each IP, and the "last number of requests entered into the database" records the number of visits to this domain name recorded in the node when the IP node data was last entered into the database.

[0071] Taking an IP node as an example, if the current number of requests of an IP node (as a specific example of the current request information) increases compared with the last number of requests for warehousing (i.e., the two are inconsistent), calculate the newly added number, and update the last number of requests for warehousing in the IP node to the current number of requests. Afterwards, record the warehousing time, domain name MD5, IP, and the number of newly added requests in the IP request domain name table of the database. If the current number of requests in an IP node has not increased (i.e., consistent), check whether the most recent IP access time in the IP node has timed out. If it has timed out, delete the IP node and the related information of the IP node therein. The second threshold can be set according to the actual application scenario, and the embodiment of the present application is not specifically limited here.

[0072] The following is combined with Figure 5 The specific process of domain name data caching provided by some embodiments of the present application is exemplified.

[0073] Please see attached Figure 5 , Figure 5 A flow chart of a method for caching domain name data provided for some embodiments of the present application.

[0074] The above implementation process is described below by way of example.

[0075] S510, obtaining DNS data in the data packet.

[0076] The DNS data is a specific example of the domain name information of the target domain name node.

[0077] S520, performing hash calculation on the DNS data to obtain a hash value of the target domain name.

[0078] The target domain name hash value is a specific example of the target domain name index value.

[0079] S530, search in the domain name hash table with the target domain name hash value as the index to determine whether the target domain name node exists, if so, execute S540, otherwise execute S550.

[0080] S540, updating the access time of the DNS data.

[0081] S550, add a new DNS node, add DNS data and DNS access time.

[0082] S560, calculate the IP hash value of the source IP in the data packet.

[0083] Among them, the source IP is used as a target IP node, and the IP hash value is used as a specific example of the source IP index value.

[0084] S570, search in the IP hash table with the IP hash value as the index to determine whether the source IP node exists, if so, execute S580, otherwise execute S590.

[0085] S580, update the access time of the source IP node and increase the access count.

[0086] S590, add a new source IP node, and add the access time and access count of the source IP node.

[0087] It can be understood that the specific implementation process of S510 to S590 can refer to the method embodiment provided above, and in order to avoid repetition, the detailed description is appropriately omitted here.

[0088] The following is combined with Figure 6 The specific process of domain name information management provided by some embodiments of the present application is exemplified.

[0089] Please see attached Figure 6 , Figure 6 A flow chart of a method for domain name information management provided for some embodiments of the present application.

[0090] The above implementation process is described below by way of example.

[0091] S601, read the i-th domain name node data in the domain name hash table.

[0092] The domain name hash table may include N domain name nodes, and the value of i is [1, N].

[0093] S602, determine whether the i-th domain name node is stored for the first time, if so, execute S603, otherwise execute S604.

[0094] S603, record the domain name, domain name MD5 value and other domain name related information of the i-th domain name node in the domain name information table, and execute S605.

[0095] S604, determine whether the access time of the i-th domain name node has timed out, if not, execute S605, if yes, execute S612.

[0096] S605, read the j-th IP node data in the IP hash table in the i-th domain name node.

[0097] The IP hash table may include M IP nodes, and the value of j is [1, M].

[0098] S606, determine whether the number of requests of the j-th IP node increases, if so, execute S607, otherwise execute S609.

[0099] S607, calculating the number of newly added requests of the j-th IP node, and updating the number of requests of the j-th IP node to the current number of requests.

[0100] Among them, the number of new requests for the j-th IP node is the difference between the current number of requests and the current number of storage times at the last entry.

[0101] S608, the IP hash table records the access time, domain name MD5 value, IP and current request times of the jth IP node.

[0102] S609, determine whether the access time of the j-th IP node has timed out, if so, execute S610, otherwise execute S611.

[0103] S610, delete the jth IP node.

[0104] S611, determine whether the traversal of the IP hash table is complete, if so, execute S613, otherwise execute S614.

[0105] S612, delete the i-th domain name node.

[0106] S613, determine whether the traversal of the domain name hash table is complete, if so, end, otherwise execute S615.

[0107] S614, set j=j+1, and return to S605.

[0108] S615, set i=i+1, and return to S601.

[0109] It can be understood that the specific implementation process of S601 to S615 can refer to the method embodiment provided above, and in order to avoid repetition, the detailed description is appropriately omitted here.

[0110] In addition to the scheme of regularly traversing the domain name hash table and IP hash table provided in the above embodiment of the application, based on the real-time table of the IP request domain name table that is stored once every preset period, the statistical module inside the application system 200 can also summarize the contents of the data table at regular time periods. For example, the cached data within 1 minute in the "real-time table" is stored in the "minute table" every minute, the cached data in the "minute table" is stored in the "hour table" every hour, and the cached data in the "hour table" is stored in the "day table" every day. The specific time period for summarizing data can be flexibly set, and the embodiments of the present application are not limited to this.

[0111] The following takes the above domain name information management method applied to a firewall system (as a specific example of the application system 200) as an example, and combines the attached Figure 7 The implementation process of the present application is described by way of example.

[0112] Please see attached Figure 7 The schematic diagram of domain name information management is shown. Specifically, when user 1 requests domain name 1 (that is, a domain name node) for the first time, the statistics module will add a domain name 1 cache node and an IP1 cache node, and record the cache request information of IP1 requesting domain name 1, such as the number of requests and time. Later, when the firewall receives the domain name 1 response message from the server, it will not add a new node, but directly update the cache information, such as time and number, in the previously added domain name 1 node. For example, count the number of DNS request responses or update the number of successful or failed requests based on the response message information. Later, when user 1 requests domain name 1 again, the time and number are still directly updated in the previous domain name 1 cache node and IP1 cache node. When user 2 also requests domain name 1, the IP2 node is added to the IP cache table of the domain name 1 node for caching information.

[0113] The cache table is traversed every 5 seconds, and the number of times IP1 and IP2 request domain name 1 within 5 seconds is stored in the real-time table of the IP request domain name table. If the information of domain name 1 has not been stored before, the information of domain name 1 will be stored in the domain name information table. After that, the content in the data table is summarized at regular intervals, stored in a data table with a larger time range, and the old data is deleted. For example, after 1 minute, the total number of times IP1 requests domain name 1 in the real-time table of the IP request domain name table will be calculated within one minute and stored as a piece of data in the minute table. The old data in the real-time table is deleted according to business needs. For example, if the business needs to display real-time data of DNS requests within one minute, when the data is summarized, the data one minute before the summary time point is deleted to ensure that the business function is not affected.

[0114] It can be seen from the solutions provided by some embodiments of the present application above that, compared with the method of adding each DNS message information to the message queue cache or directly recording it to the log, the method of integrating cached DNS information using a data table with an index value can reduce the consumption of device performance caused by frequent addition of cache nodes, reduce the consumption of device memory caused by repeated cache information, and reduce the consumption of device performance caused by writing files. Compared with the method of directly reading information from the message queue cache and storing it in the warehouse, integrating cached data and storing it in the warehouse once according to a preset period can reduce the consumption of frequent data storage in the warehouse, as well as reduce the number of stored data entries and improve query efficiency. Compared with the method of aggregating and storing data at least once every hour, storing it in the warehouse once every certain period can reflect the DNS request situation in real time. By recording DNS information and IP request domain name separately, duplicate DNS information can be reduced. Aggregating the information in the data table into a data table with a larger time span and deleting old data at regular intervals can reduce the occupancy of device memory.

[0115] Please refer to Figure 8 , Figure 8 The block diagram of the domain name information management device provided by some embodiments of the present application is shown. It should be understood that the domain name information management device corresponds to the above method embodiment and can execute each step involved in the above method embodiment. The specific functions of the domain name information management device can be found in the above description. To avoid repetition, the detailed description is appropriately omitted here.

[0116] Figure 8 The domain name information management device includes at least one software function module that can be stored in a memory in the form of software or firmware or solidified in the domain name information management device, and the domain name information management device includes: a first management module 810, which is used to traverse the domain name cache data table, and when it is confirmed that the domain name information of each domain name node exists in the database and the domain name access time does not exceed the first threshold, read the IP cache data table in each domain name node; a second management module 820, which is used to traverse the IP cache data table, determine the latest request information of each IP node, and delete the IP node whose IP node access time exceeds the second threshold, to obtain the latest domain name cache data table and the latest IP cache data table; wherein, the domain name cache data table caches multiple domain name index values ​​and the domain name nodes cached under each domain name index value; the IP cache data table caches multiple IP index values ​​and the IP nodes cached under each IP index value.

[0117] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method, and will not be described in detail here.

[0118] Some embodiments of the present application further provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the operations of the method corresponding to any of the above methods provided in the above embodiments.

[0119] Some embodiments of the present application further provide a computer program product, which includes a computer program, wherein when the computer program is executed by a processor, it can implement the operations corresponding to any of the above methods provided in the above embodiments.

[0120] like Fig. 9 As shown, some embodiments of the present application provide an electronic device 900, which includes: a memory 910, a processor 920, and a computer program stored in the memory 910 and executable on the processor 920, wherein the processor 920 can implement a method as described in any of the above embodiments when reading the program from the memory 910 through a bus 930 and executing the program.

[0121] Processor 920 can process digital signals and can include various computing structures, such as complex instruction set computer structure, reduced instruction set computer structure, or a structure that implements a combination of multiple instruction sets. In some examples, processor 920 can be a microprocessor.

[0122] The memory 910 may be used to store instructions executed by the processor 920 or data related to the execution of instructions. These instructions and / or data may include codes for implementing some or all functions of one or more modules described in the embodiments of the present application. The processor 920 of the disclosed embodiment may be used to execute instructions in the memory 910 to implement the method shown above. The memory 910 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memory known to those skilled in the art.

[0123] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0124] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0125] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A method for managing domain name information, characterized in that: include: Traversing the domain name cache data table, and when confirming that the domain name information of each domain name node exists in the database and the domain name access time does not exceed the first threshold, reading the IP cache data table in each domain name node; Traversing the IP cache data table, determining the latest request information of each IP node, and deleting the IP nodes whose IP node access time exceeds the second threshold, to obtain the latest domain name cache data table and the latest IP cache data table; The domain name cache data table caches a plurality of domain name index values ​​and a domain name node cached under each domain name index value; the IP cache data table caches a plurality of IP index values ​​and an IP node cached under each IP index value.

2. The method according to claim 1, characterized in that Before confirming that the domain name information of each domain name node exists in the database, the method further includes: If it is confirmed that any domain name node is cached in the database for the first time, the domain name information of any domain name node is recorded in the domain name information table, wherein the domain name information of any domain name node includes: domain name, domain name summary value and other related information.

3. The method according to claim 1 or 2, characterized in that The method further includes: deleting, from the domain name cache data table, domain name nodes whose domain name access time exceeds the first threshold.

4. The method according to claim 1 or 2, characterized in that: Determining the latest request information of each IP node includes: If the current request information of each IP node is consistent with the current storage information, confirm that the current storage information is the latest request information, and retain the IP nodes whose IP access time does not exceed the second threshold; If it is confirmed that the current request information and the current stored information are inconsistent, the current stored information is updated to the current request information, and the current request information is the latest request information.

5. The method according to claim 1 or 2, characterized in that: The domain name cache data table is obtained by the following method: Calculate the domain name information of the acquired target domain name node to obtain the target domain name index value corresponding to the target domain name node; Based on the target domain name index value, confirm whether the target domain name node exists in the domain name cache data table, and record the target domain name information and the target domain name access time of the target domain name node.

6. The method according to claim 5, characterized in that The step of confirming whether the target domain name node exists in the domain name cache data table based on the target domain name index value, and recording the target domain name information and the target domain name access time of the target domain name node includes: If it is confirmed that the target domain name node exists in the domain name cache data table, updating the target domain name access time; If it is confirmed that the target domain name node does not exist in the domain name cache data table, the target domain name node is added, and the target domain name information and the target domain name access time are added.

7. The method according to claim 6, characterized in that After recording the target domain name information and the target domain name access time of the target domain name node, the method further includes: Confirm whether the target IP node exists in the IP cache data table in the target domain name node, and record the IP request information of the target IP node, wherein the IP request information includes the IP access time and the IP access count.

8. The method according to claim 7, characterized in that The step of confirming whether a target IP node exists in the IP cache data table in the target domain name node and recording IP request information of the target IP node includes: Calculate the source IP request to obtain the source IP index value; When the corresponding target IP node is found in the IP cache data table through the source IP index value, updating the IP request information; When the corresponding target IP node is not found in the IP cache data table through the source IP index value, the target IP node and the IP request information are added.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program executes the method according to any one of claims 1 to 8 when executed by a processor.

10. An electronic device, characterized in that: The method comprises a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the computer program executes the method according to any one of claims 1 to 8 when being run by the processor.

11. A computer program product, characterized in that The computer program product comprises a computer program, wherein the computer program executes the method according to any one of claims 1 to 8 when executed by a processor.

Images