Domain name resolution method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to a domain name resolution method and device, computer equipment, a readable storage medium and a program product. According to the method, the extended domain name data of the multi-source domain name data is acquired, the domain name preservation database is generated according to the multi-source domain name data and the extended domain name data, and the domain name resolution request can be responded based on the domain name preservation database under the condition of determining that the domain name service system fails. Therefore, under the extreme condition, the safe analysis service of the DNS can be provided, and the availability of the internet service is ensured. The method is not limited to existing technologies such as RPZ rules, domain name preservation can be completed without modifying existing DNS nodes, and normal operation of Internet services can be guaranteed when risks of unilateral revocation or tampering caused by mechanism side power abuse and the like occur.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a domain name resolution method, apparatus, computer equipment, readable storage medium and program product. Background Art

[0002] DNS (Domain Name System) is an important part of the Internet. Users need to resolve domain names through DNS to access websites. In the traditional DNS system, root servers generally need to use the root zone provided by IANA (The Internet Assigned Numbers Authority, responsible for coordinating the root domain names of the global DNS, the allocation of IP addresses (Internet Protocol Addresses) and other Internet Protocol resources) for domain name resolution.

[0003] However, if the IANA function is attacked, it will cause service interruption and domain name ownership will face the risk of being unilaterally revoked by the organization. For example, if the root zone is deleted or the top-level domain is tampered with, the domain names under the top-level domain tree cannot be resolved or will be resolved incorrectly, resulting in interruption of the domain name corresponding service. Summary of the invention

[0004] Based on this, it is necessary to provide a method, apparatus, computer device, computer-readable storage medium and computer program product that can effectively and accurately resolve domain name in response to the above technical problems.

[0005] In a first aspect, the present application provides a domain name resolution method, the method comprising:

[0006] Acquire extended domain name data of multi-source domain name data, wherein the multi-source domain name data includes domain name data acquired from multiple channels;

[0007] Generate a domain name preservation database according to the multi-source domain name data and the extended domain name data;

[0008] In the case where it is determined that the domain name service system fails, a domain name resolution request is responded to based on the domain name preservation database.

[0009] In one of the embodiments, before obtaining the extended domain name data of the multi-source domain name data, the method also includes: collecting basic domain name information based on active or passive means to obtain first domain name data; obtaining second domain name data in at least one target scenario, the second domain name data including at least one of a CDN domain name, a reverse domain name, and a target top-level domain name; and standardizing the first domain name data and the second domain name data to obtain standardized multi-source domain name data.

[0010] In one of the embodiments, the obtaining of extended domain name data of multi-source domain name data includes: performing domain name expansion according to the multi-source domain name data to obtain extended domain name data; performing domain name prediction according to the multi-source domain name data to obtain predicted domain name data; obtaining at least one of the expanded domain name data and the predicted domain name data as extended domain name data.

[0011] In one of the embodiments, the domain name expansion based on the multi-source domain name data to obtain the expanded domain name data includes at least one of the following: domain name expansion based on pattern recognition to obtain the expanded domain name data; acquiring attribute information of the multi-source domain name data, and expanding the domain name according to the correlation between the attribute information to obtain the expanded domain name data; clustering the multi-source domain name data to obtain a clustering result, and domain name expansion of the clustering result to obtain the expanded domain name data.

[0012] In one of the embodiments, performing domain name prediction based on the multi-source domain name data to obtain predicted domain name data includes: crawling page data based on the multi-source domain name data to obtain corpus information in the page data; constructing different types of knowledge bases based on the corpus information, and performing online learning on a pre-trained domain name prediction model based on the knowledge base to obtain a learned domain name prediction model; and using the learned domain name prediction model to generate a predicted domain name set for the multi-source domain name data to obtain predicted domain name data.

[0013] In one of the embodiments, generating a domain name preservation database based on the multi-source domain name data and the extended domain name data includes: cleaning and aggregating the multi-source domain name data and the extended domain name data to obtain a candidate domain name preservation database; verifying the authenticity of the candidate domain names in the candidate domain name preservation database to obtain target candidate domain names that pass the authenticity verification; and generating the domain name preservation database based on the target candidate domain names.

[0014] In one of the embodiments, responding to the domain name resolution request based on the domain name preservation database includes: loading the domain name preservation database into a recursive server or a cache, and using the recursive server or the cache to respond to the domain name resolution request.

[0015] In one of the embodiments, the response to the domain name resolution request based on the domain name preservation database includes: classifying and sorting the domain name data in the domain name preservation database based on preset topological attributes, and storing them in a red-black tree structure; determining a topological label corresponding to the domain name resolution request for the domain name resolution request; searching for a resolution result corresponding to the domain name resolution request in the stored red-black tree structure according to the topological label; and returning the resolution result in response to the domain name resolution request.

[0016] In a second aspect, the present application also provides a domain name resolution device, including:

[0017] A data acquisition module is configured to acquire extended domain name data of multi-source domain name data, wherein the multi-source domain name data includes domain name data acquired from multiple channels;

[0018] A database generation module, configured to generate a domain name preservation database according to the multi-source domain name data and the extended domain name data;

[0019] The resolution module is configured to respond to the domain name resolution request based on the domain name preservation database when it is determined that the domain name service system fails.

[0020] In a third aspect, the present application further provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the method described in the first aspect when executing the computer program.

[0021] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the method described in the first aspect above.

[0022] In a fifth aspect, the present application further provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the method described in the first aspect above.

[0023] The above-mentioned domain name resolution method, device, computer equipment, computer-readable storage medium and computer program product obtain the extended domain name data of multi-source domain name data, and generate a domain name preservation database based on the multi-source domain name data and the extended domain name data. When it is determined that the domain name service system fails, the domain name resolution request can be responded to based on the domain name preservation database. Thereby, in extreme cases, the DNS security resolution service can be provided, and the availability of Internet services is guaranteed. It is not limited to existing technologies such as RPZ rules, and there is no need to transform existing DNS nodes to complete domain name preservation. When there is a risk of unilateral revocation or tampering caused by abuse of power on the institutional side, the normal operation of Internet services can be guaranteed. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments of the present application or the related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0025] Figure 1 A schematic diagram of a traditional DNS system in one embodiment;

[0026] Figure 2 A schematic diagram of a flow chart of a domain name resolution method in one embodiment;

[0027] Figure 3 A flowchart of the steps of obtaining multi-source domain name data in one embodiment;

[0028] Figure 4 A schematic diagram of a flow chart of steps for obtaining extended domain name data in one embodiment;

[0029] Figure 5 A schematic diagram of a flow chart of steps for generating a domain name preservation database in one embodiment;

[0030] Figure 6 A schematic diagram of domain name preservation database analysis in one embodiment;

[0031] Figure 7 A schematic diagram of a process of responding to a domain name resolution request in one embodiment;

[0032] Figure 8 A schematic diagram of a process of adaptive parsing in one embodiment;

[0033] Fig. 9 is a structural block diagram of a domain name resolution device in one embodiment;

[0034] Fig.10 A schematic diagram of a domain name resolution device in one embodiment;

[0035] Fig.11 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0037] Because in the traditional DNS system, such as Figure 1As shown in the figure, when the functions of the authoritative side such as IANA are attacked, service interruption will occur, and the ownership of domain names (including but not limited to top-level domains, important domains, etc.) will face the risk of being unilaterally revoked by the organization, including:

[0038] Registry risk. For example, the registry management agency of top-level domain names such as com is a foreign organization. Under special conditions, the organization can suspend or hijack the domain names it manages, resulting in all important second-level domain names (such as .com) being banned or redirected.

[0039] Registrar risk. For example, the registrars of domain names such as ".com", ".net", and ".org" are generally foreign registrars, which usually modify the Name Server of the registered domain name (the name server is part of the DNS and is responsible for resolving user-readable domain names into computer-recognizable IP addresses). Therefore, the registrar can ban or redirect these domain names based on the Name Server, making the domain names at risk of being hijacked.

[0040] Hosting provider risk. The hosting providers of some important domestic domain names such as ".com", ".net" and ".org" are foreign cloud operators. Under certain circumstances, there is a risk that the hosting providers will stop resolving these domain names.

[0041] According to statistics, the number of active domain names in my country registered in foreign top-level domains exceeds 10 million, and the services carried by active domain names registered abroad include all aspects of my country's government, institutions, finance, infrastructure, and leading enterprises. Once these domain names are at risk, it will seriously affect my country's network security.

[0042] Therefore, some people have proposed means to preserve important domain name resources, such as coordinated domain name migration and recursive side resolution guarantee. Among them, coordinated domain name migration is to migrate important domain name resources of national military industry, finance and other enterprises to ".cn", which is mainly achieved through manual cooperation. However, after the risk occurs, those domain name resources that have not been migrated to ".cn" in time will not be preserved; and the manual migration method has a long cycle, high cost, and limited impact range; and there is a lack of preservation means for ".CDN" (Content Delivery Network), reverse domain names, etc.

[0043] The recursive side resolution guarantee is achieved by using forced resolution on the resolution side, which is achieved by manually sending forced resolution information. However, in this mode, for each domain name, forced resolution only corresponds to 1-2 IPs, and in actual applications, it is necessary to face the pressure of tens of millions of QPS (Queries-per-second). If the pressure is placed on existing resources, it may cause resource paralysis. In addition, the resource addresses are manually distributed to various places, which not only has low resolution efficiency, but also has the problem of poor user experience.

[0044] Although there are solutions to respond to the client's request for domain name resolution by adding plug-ins and modules on the recursive side, such as adding a new RPZ (Response Policy Zones) server, synchronously configuring the recursive server, and interconnecting the two servers, including the first zone addition module, RPZ activation module, forwarding configuration module, and RPZ configuration module in the recursive server; and adding trusted records related to the specified domain name in the RPZ zone file of the RPZ server to complete the domain name preservation. However, this solution not only requires the transformation of existing DNS nodes, but is also limited to existing RPZ rules, and cannot be preserved for situations outside the coverage of existing RPZ rules.

[0045] Based on this, an embodiment of the present application provides a domain name resolution method, which obtains the extended domain name data of multi-source domain name data, and generates a domain name preservation database based on the multi-source domain name data and the extended domain name data. When it is determined that the domain name service system fails, the domain name resolution request is responded to based on the domain name preservation database. Thereby, in extreme cases, it is possible to provide DNS security resolution services and ensure the availability of Internet services. It is not limited to existing technologies such as RPZ rules, and it does not need to transform existing DNS nodes to complete domain name preservation. When there is a risk of unilateral revocation or tampering caused by abuse of power on the institutional side, the normal operation of Internet services can be guaranteed.

[0046] In one embodiment, Figure 2 As shown, a domain name resolution method is provided, the method comprising the following steps:

[0047] Step 202: Acquire extended domain name data of multi-source domain name data.

[0048] Among them, multi-source domain name data may include domain name data obtained from multiple channels, including but not limited to domain name data obtained from DNS resolution records, domain name data captured using browser plug-ins, domain name data obtained by analyzing domain name registration information, and domain name data issued by competent authorities.

[0049] Extended domain name data refers to new domain name data obtained by supplementing and increasing multi-source domain name data.

[0050] In this embodiment, supplementation and addition are performed based on the collected multi-source domain name data, thereby obtaining extended domain name data of the multi-source domain name data.

[0051] Step 204: Generate a domain name preservation database based on the multi-source domain name data and the extended domain name data.

[0052] The domain name preservation database is a file-based database obtained by verifying and integrating multi-source domain name data and extended domain name data, which stores the mapping relationship between domain names and IP addresses.

[0053] Step 206: When it is determined that the domain name service system fails, respond to the domain name resolution request based on the domain name preservation database.

[0054] The domain name service system can be the DNS authoritative server of the root domain name, the DNS authoritative server of the top-level domain, or the DNS authoritative server of the second-level domain. A domain name resolution request refers to an instruction or command to perform domain name resolution to obtain an IP address, and the domain name resolution request includes the specific domain name to be resolved. Domain name service system failures include, but are not limited to, DNS authoritative node failures, service interruptions caused by unilateral revocation of domain names, and malicious domain name resolution based on threat intelligence.

[0055] Usually under the DNS system, the DNS server can respond to the domain name resolution request by means of cache resolution or recursive resolution, thereby returning the resolution result including the IP address corresponding to the domain name resolution request. Among them, recursive resolution means that after receiving the request from the client, if the DNS server does not have the record of the domain name locally, it will send a query request to other DNS servers on behalf of the client until the corresponding IP address is found. Since the DNS server will continue to send query requests to other DNS servers until the final answer is found, this process is recursive. Cache resolution means that the DNS server stores the queried domain name and the corresponding IP address in the cache, so that the data in the cache can be directly used in future queries without the need for recursive query again. However, in the case of a domain name service system failure, that is, a DNS server failure or a domain name unilaterally revoked by an organization, accurate resolution cannot be performed.

[0056] Therefore, in this embodiment, when it is determined that the domain name service system fails, the domain name preservation database generated based on the above steps can respond to the domain name resolution request to provide DNS security resolution service.

[0057] In the above domain name resolution method, by obtaining the extended domain name data of multi-source domain name data, and generating a domain name preservation database based on the multi-source domain name data and the extended domain name data, when it is determined that the domain name service system fails, the domain name resolution request can be responded to based on the domain name preservation database. Thereby, in extreme cases, it is possible to provide DNS security resolution services and ensure the availability of Internet services. It is not limited to existing technologies such as RPZ rules, and it does not need to transform existing DNS nodes to complete domain name preservation. When there is a risk of unilateral revocation or tampering caused by abuse of power on the institutional side, it can ensure the normal operation of Internet services.

[0058] In an exemplary embodiment, Figure 3 As shown, in step 202, before obtaining the extended domain name data of the multi-source domain name data, the above method may further include:

[0059] Step 302: Collect basic domain name information in an active or passive manner to obtain first domain name data.

[0060] Among them, actively collecting basic domain name information can include using crawler technology to actively collect domain name data from the Internet (including but not limited to social media, forums, blogs and other public information sources). It can also include using API interfaces to obtain domain name data from third-party data providers. It is also possible to record DNS requests in network traffic through traffic monitoring equipment or software to extract the domain name information visited. It can also include analyzing log files (such as Web server logs) to extract domain name information visited by users. Passively collecting basic domain name information can be receiving domain name lists provided by the competent authority, which may be provided based on specific business needs or security requirements.

[0061] Specifically, the collection of basic domain name information includes but is not limited to the following methods: using whois (a tool for querying domain name registration information) to query the registration information of the domain name to obtain the basic domain name information. Using record or credit query services to analyze the owner information and related credit records (such as domain name registrants, registrars, DNS servers, etc.) to obtain basic domain name information. Using browser plug-ins to assist in discovering and recording visited domain names. Using online platforms and resource search engines (such as VirusTotal (a website that provides suspicious file analysis services), Censys (cyberspace search engine), etc.) to search and discover subdomains. Using enumeration tools (such as Sublist3r (a subdomain enumeration tool), Amass (a tool for performing subdomain blasting and information collection), etc.) to automatically discover subdomains. Using certificate transparency public logs (such as crt.sh (a tool for collecting subdomains using certificate transparency)) to find SSL (Secure socketlayer) / TLS (Transport Layer Security) certificates associated with specific domain names, thereby discovering subdomains. Analyze DNS historical resolution records and exploit DNS domain transfer vulnerabilities (such as Baligad Resolver) to further discover subdomains. It is understandable that the above methods of collecting basic domain name information are all carried out with full authorization.

[0062] In this embodiment, the basic domain name information is collected in the above-mentioned active or passive manner to obtain the first domain name data.

[0063] Step 304: Obtain second domain name data in at least one target scenario.

[0064] The target scenario may be a specific scenario that requires domain name migration or preservation, including but not limited to CDN preservation scenarios, reverse resolution preservation scenarios, and important top-level domain preservation scenarios, etc. The second domain name data includes at least one of a CDN domain name obtained based on a CDN preservation scenario, a reverse domain name obtained based on a reverse resolution preservation scenario, and a target top-level domain name obtained based on an important top-level domain preservation scenario.

[0065] A CDN domain name refers to a domain name that is accelerated through a content delivery network (CDN) service. CDN is a distributed network service that deploys server nodes in multiple locations around the world and caches the content of a website on the server closest to the user, thereby speeding up content loading and improving user experience. A CDN domain name is a domain name that points to the content on these servers that have been accelerated by the CDN. When a user tries to access a specific resource on a website that uses CDN services, DNS resolution will direct the user's request to the nearest CDN node instead of directly connecting to the origin server. If the CDN node has already cached the requested resource, it will be returned directly to the user; if it is not cached, the CDN node will request the resource from the origin server and cache it for future access.

[0066] In some embodiments, commands such as ping (Internet packet explorer) and nslookup (a network management command line tool) can be used to determine whether a domain name uses CDN services. If it is confirmed that CDN is used, the IP address of the mail server can be found through the MX record (a DNS record used to specify the mail server responsible for processing mails sent to the recipient's domain name), and the mail server IP can be pinged again or other detection methods can be used to try to obtain the real source station IP address. Finally, the real IP address obtained can be reversed to find more possible CDN domain names and related information.

[0067] Reverse domain name refers to finding the corresponding domain name from a given IP address. In the DNS system, the usual domain name resolution is from the domain name to the IP address, while reverse domain name resolution is from the IP address to the domain name, which allows the client to query the corresponding domain name through the IP address. For example, mail servers usually use reverse DNS to verify whether the sender's IP address matches the domain name it claims to reduce spam and fraud. When performing a reverse DNS query, the client sends a special query request to the DNS server, which contains the IP address to be queried. After receiving the query request, the DNS server will try to find the domain name associated with the IP address. If a matching domain name is found, the DNS server will return the domain name as a response; if not found, a corresponding error message or an empty response is returned.

[0068] In some embodiments, tools such as nmap (a port scanning tool for large networks), dig (a command-line tool for querying DNS information), and nslookup can be used to query the domain name information corresponding to a specific IP address to obtain the reverse domain name. This helps to understand which domain names may be hosted on the same server, or which domain names the IP address has hosted. Reverse DNS can then be configured on the DNS server, adding a PTR record called a "reverse mapping" that maps the IP address to the domain name. For example, if there is an IP address of 192.0.2.1 and its corresponding domain name is example.com, then a PTR record can be created on the DNS server indicating that "1.2.0.192.in-addr.arpa" points to "example.com".

[0069] The target top-level domain name may be a related top-level domain name obtained based on an important top-level domain preservation scenario, for example, it may be a top-level domain name related to government, institutions, finance, infrastructure, leading enterprises, etc.

[0070] Step 306: Standardize the first domain name data and the second domain name data to obtain standardized multi-source domain name data.

[0071] Among them, standardization processing includes but is not limited to aggregation, deduplication, cleaning of invalid data and standardized format processing. Specifically, the first domain name data and the second domain name data obtained above can be integrated together, and duplicates can be removed, and then the data can be cleaned to remove invalid or erroneous domain name records. For example, the domain name resolution frequency can be extracted, and the IP address range, registration time, expiration time, etc. can be parsed as feature vectors to remove abnormal or malicious domain names. Finally, the domain name format is standardized, such as converting the domain name to lowercase letters, removing unnecessary symbols or spaces, processing subdomains, paths, etc., to make them conform to the standard format, thereby ensuring data consistency. The domain name data after cleaning and aggregation is standardized multi-source domain name data.

[0072] In this embodiment, basic domain name information is collected in an active or passive manner to obtain first domain name data, and second domain name data in at least one target scenario is obtained, and then the first domain name data and the second domain name data are standardized to obtain standardized multi-source domain name data. In this way, domain name data is collected from multiple channels to obtain multi-source domain name data as the data basis for domain name resolution.

[0073] In an exemplary embodiment, Figure 4 As shown, in step 202, obtaining the extended domain name data of the multi-source domain name data may specifically include:

[0074] Step 402, expand the domain name according to the multi-source domain name data to obtain expanded domain name data.

[0075] The domain name expansion may be a process of expanding domain name data from multiple sources to obtain more domain name data.

[0076] In some embodiments, domain name expansion can be performed on multi-source domain name data based on pattern recognition to obtain expanded domain name data. By analyzing the structure of the domain name, common naming patterns and rules can be found. Using these patterns, new domain name variants can be generated to increase the diversity of the prediction set. Specifically, pattern recognition can be performed, and domain names with the same subdomain name pattern can be identified using regular expressions according to the naming pattern, for example, using *.example.com. All records related to example.com are extracted from the data set (i.e., multi-source domain name data), and expanded according to the vocabulary to obtain more domain names, such as service.example.com, blog.example.com, etc.

[0077] In some embodiments, it is also possible to obtain attribute information of multi-source domain name data, and expand the domain name according to the correlation between the attribute information to obtain expanded domain name data. The attribute information includes, but is not limited to, the IP address corresponding to the domain name, registration information, or hosting information. Specifically, a correlation analysis can be performed based on the IP address corresponding to the domain name, and a correlation analysis can also be performed based on jointly registered or hosted domain names, such as domain names that share the same IP address or are hosted on the same server. Through these association relationships, possible new domain names can be inferred, and more domain names can be further expanded.

[0078] In some embodiments, multi-source domain name data can also be clustered to obtain clustering results, and the clustering results can be extended to obtain extended domain name data. Specifically, TF-IDF (Term Frequency_Inverse Document Frequency, a weighted technology for information retrieval and text mining) can be used to generate vectors to extract features from domain names in multi-source domain name data, and then models such as K-MEANS (a clustering analysis algorithm) can be used to cluster domain names. Among them, the feature extraction method includes but is not limited to word vector embedding that converts the main part of the domain name into a vector, character vector embedding that converts domain name characters into vectors, semantic features, other features (such as length, TLD (Top-LevelDomain, abbreviation of top-level domain name), number / letter distribution, etc.). Then, based on the clustering results, more similar domain names are found. For example, part of the vocabulary of clustered domain names can be replaced and combined to generate new domain names. If the original domain names of a certain category after clustering include: example.com, sample.net, they can be expanded to: examplesample.com, sampleline.net. You can also perform synonym and variation expansion based on natural language to expand the clustered domain names. For example, the original domain name after clustering is: fast.com, which can be expanded to quick.com and speed.com.

[0079] Step 404, performing domain name prediction based on multi-source domain name data to obtain predicted domain name data.

[0080] Among them, domain name prediction can be a process of obtaining more domain name data by using machine learning models or artificial intelligence technologies to predict based on multi-source domain name data.

[0081] In some embodiments, page data can be crawled based on multi-source domain name data to obtain corpus information in the page data; different types of knowledge bases can be constructed based on the corpus information, and a pre-trained domain name prediction model can be learned online based on the knowledge base to obtain a learned domain name prediction model; a predicted domain name set of multi-source domain name data can be generated based on the learned domain name prediction model to obtain predicted domain name data.

[0082] Specifically, page data can be crawled based on domain names, subdomains, etc. in multi-source domain name data to obtain corpus information such as contextual information and industry characteristics in the page, and different knowledge bases can be built based on the corpus information, such as industry feature libraries, geographic location feature libraries, etc., to enrich the feature representation of domain names.

[0083] And use word segmentation algorithms (such as Ngram, a statistical text processing method) to further analyze and analyze the multi-source domain name data, and extract meaningful words or phrases to form a basic corpus. For example, for the original domain name: example123.com, you can extract features such as the domain name character length (including TLD13, stem 10), and extract the word frequency statistics of the domain name stem (letters: {'e':2, 'x':1, 'a':1, 'm':1, 'p':1, 'l':1}, numbers: {'1':1, '2':1, '3':1}), and you can also count the distribution of numbers, letters, and special characters (such as letters: {'e':2, 'x':1, 'a':1, 'm':1, 'p':1, 'l':1}, numbers: {'1':1, '2':1, '3':1}), TLD (.com). Assuming that the feature vector includes the above dimensions, and TLD uses read-hot encoding, the feature vector [13, 10, 0.7, 0.3, 0.0, 1, 0, 0] can be obtained as the basic corpus. Then, the basic corpus can be used to perform pre-training using word vector models to obtain an offline domain name prediction model, so as to better understand the semantic information in the domain name.

[0084] Then, according to different knowledge bases, the offline domain name prediction model is learned online to fine-tune the model so that it can adapt to new domain name patterns and changing trends. Then, the feature group of the above basic corpus is input into the fine-tuned model to generate a predicted domain name set to discover more potential domain names.

[0085] In some embodiments, in order to further enrich the domain name data, domain name expansion can be performed on multi-source domain name data. After obtaining the expanded domain name data, the expanded domain name data can be fused with the multi-source domain name data to obtain fused domain name data, and then domain name prediction can be performed based on the fused domain name data to obtain more predicted domain name data.

[0086] Step 406: Acquire at least one of the expanded domain name data and the predicted domain name data as the extended domain name data.

[0087] Specifically, at least one of the expanded domain name data and predicted domain name data obtained above can be used as extended domain name data, and then the extended domain name data can be merged with multi-source domain name data to generate a domain name preservation database, thereby providing a comprehensive and reliable data foundation for subsequent analysis and application.

[0088] In the above embodiment, domain name expansion is performed based on multi-source domain name data to obtain expanded domain name data, and domain name prediction is performed based on multi-source domain name data to obtain predicted domain name data, and at least one of the expanded domain name data and the predicted domain name data is obtained as extended domain name data. By performing domain name expansion on multi-source domain name data in different ways, rich extended domain name data can be obtained, providing more comprehensive data support for subsequent analysis and application.

[0089] In an exemplary embodiment, Figure 5 As shown, in step 204, a domain name preservation database is generated according to the multi-source domain name data and the extended domain name data, which may specifically include:

[0090] Step 502: Clean and aggregate the multi-source domain name data and the extended domain name data to obtain a candidate domain name preservation database.

[0091] Among them, cleaning and aggregation include but are not limited to merging data and performing cleaning and standardization. Specifically, multi-source domain name data and extended domain name data can be merged, and then invalid, erroneous or incomplete domain name records in the merged data can be cleaned. For example, a hash table or set data structure can be used to store and check uniqueness to ensure that each domain name is unique and avoid duplicate domain names; regular expression matching can also be used to filter out records that do not conform to the domain name format, or blacklist filtering can be used to exclude known malicious domain names or junk domain names. The cleaned data is standardized to conform to the standard format, thereby obtaining a candidate domain name preservation database.

[0092] Step 504: Authenticity verification is performed on the candidate domain names in the candidate domain name preservation database to obtain target candidate domain names that pass the authenticity verification.

[0093] Among them, authenticity verification is used to verify the authenticity of the candidate domain name in the candidate domain name preservation database to ensure that the subsequent domain name resolution process can be correctly resolved. Specifically, the authenticity of the candidate domain name can be verified based on dialing or curl operations. For example, the access behavior of real users to the candidate domain name can be simulated based on dialing. If a correct response can be obtained, it means that the authenticity verification of the candidate domain name has passed. If there is no response or a correct response cannot be obtained, it means that the authenticity verification of the candidate domain name has failed.

[0094] In this embodiment, authenticity verification is performed on each candidate domain name in the candidate domain name preservation database to obtain a target candidate domain name that has passed the authenticity verification.

[0095] Step 506: Generate a domain name preservation database based on the target candidate domain name.

[0096] Specifically, based on the target candidate domain names that have passed the authenticity verification, a comprehensive and accurate domain name database, namely a domain name preservation database, can be effectively constructed, thereby providing a solid data foundation for subsequent network security monitoring and management.

[0097] In some embodiments, for the target candidate domain names that have passed the authenticity verification mentioned above, they can also be classified and graded, and an important domain name database can be formed based on cross-top-level domains, CDN services, reverse registration type domain names, etc., and the important domain name database can be used as a domain name preservation database, thereby achieving the preservation of key domain names.

[0098] In an exemplary embodiment, Figure 6 As shown, if the DNS node on the authoritative side fails, it can switch to other DNS nodes, specifically by importing the data of the above-mentioned domain name preservation database to achieve normal domain name resolution. The specific resolution side includes but is not limited to recursive measurement, cache side and adaptive resolution side. Among them, whether the DNS node on the authoritative side fails can be judged by detecting the resolution response time or success rate of a specific domain name.

[0099] In some embodiments, taking the resolution side as a recursive side as an example, when the DNS node on the authoritative side fails, the domain name preservation database can be loaded into the recursive server, so that the recursive server is used to respond to the domain name resolution request.

[0100] In some embodiments, taking the resolution side as a cache as an example, when the DNS node on the authoritative side fails, the above-mentioned domain name preservation database can be loaded into the cache, and the cached domain name preservation database can be used to respond to the domain name resolution request.

[0101] In some embodiments, taking the resolution side as an adaptive resolution side as an example, before caching or loading the domain name preservation database on the recursive server, it can be stored based on the topological attributes of the domain name, and when processing the resolution traffic, the result with the optimal geographical location is returned, thereby achieving an authoritative role for the terminal and LDNS (Lightweight DNS, a library focusing on DNS tool programming) and satisfying the delay optimization effect.

[0102] Specifically, the above-mentioned adaptive parsing process is further described below. Figure 7 As shown, in step 204, based on the domain name preservation database, it may specifically include:

[0103] Step 702: Classify and sort the domain name data in the domain name preservation database based on preset topological attributes, and store them in a red-black tree structure.

[0104] The topological attributes may include at least one of the geographical location attributes of the domain name corresponding to the IP and the operator attributes. The geographical location attributes include, but are not limited to, city, province, region, and country. The red-black tree is a self-balancing binary search tree, each node of which has a color attribute (red or black) and satisfies specific balance conditions to ensure that the tree is roughly balanced, so that basic operations such as search, insertion, and deletion can be completed in logarithmic time.

[0105] For example, the domain name data loaded into the domain name preservation database of the resolution system can be classified and sorted according to geographic location and operator through attributes such as city, province, region, country, and operator, and these attributes can be used as keys to build a red-black tree, so as to quickly build an in-memory red-black tree. For example, a combination of "city + operator" can be used as a key to ensure the balance of the tree and efficient search. You can also set priorities according to your needs, such as indexing by city and province first, and then considering operators and countries. This ensures that relevant nodes can be quickly located when searching.

[0106] Step 704: for the domain name resolution request, determine a topology label corresponding to the domain name resolution request.

[0107] The topology label may be a topology attribute label corresponding to the red-black tree constructed above. Specifically, all incoming traffic requests, i.e., domain name resolution requests, may be captured at the resolution entry point, and address and operator topology analysis may be performed, thereby adding a corresponding topology label to each incoming network resolution traffic, i.e., domain name resolution request. For example, Figure 8 As shown, the source IP address of each domain name resolution request can be analyzed to determine its geographical location or operator information. Based on the identified information, each request can be labeled with a corresponding tag, such as "Hangzhou user", "Guangzhou user", etc.

[0108] Step 706: Search the stored red-black tree structure for a resolution result corresponding to the domain name resolution request according to the topology label.

[0109] Specifically, the red-black tree in memory can be quickly matched according to the marked label (i.e. the topological label corresponding to the domain name resolution request), so as to complete the intelligent resolution and obtain the resolution result. For example, the requested label can be used to search in the red-black tree. Once a matching node is found, the resolution result stored in the node can be obtained. Due to the self-balancing characteristics of the red-black tree, the search speed can be maintained efficiently even in the case of large amounts of data.

[0110] Step 708, in response to the domain name resolution request, return the resolution result.

[0111] After finding the resolution result corresponding to the domain name resolution request based on the above steps, the domain name resolution request can be responded to and the resolution result can be returned, that is, the resolution result is returned to the requesting party, thereby completing the entire resolution process.

[0112] In this embodiment, the domain name data in the domain name preservation database is classified and sorted based on the preset topological attributes and stored in a red-black tree structure. For a domain name resolution request, a topological label corresponding to the domain name resolution request is determined, and the resolution result corresponding to the domain name resolution request is searched in the stored red-black tree structure according to the topological label, so as to respond to the domain name resolution request and return the resolution result. By utilizing the efficient search characteristics of the red-black tree and combining multi-dimensional labels, it can realize fast and accurate adaptive resolution services and improve user experience.

[0113] In one scenario, if the domain name service system is detected to have resumed normal operation, the domain name resolution can be smoothly migrated back to the normal DNS node, thereby improving the security and reliability of DNS resolution and reducing the risks caused by the unavailability of the IANA organization.

[0114] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0115] Based on the same inventive concept, the embodiment of the present application also provides a domain name resolution device for implementing the domain name resolution method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more domain name resolution device embodiments provided below can refer to the limitations on the domain name resolution method above, and will not be repeated here.

[0116] In an exemplary embodiment, Fig. 9 As shown, a domain name resolution device is provided, including: a data acquisition module 902, a database generation module 904 and a resolution module 906, wherein:

[0117] The data acquisition module 902 is configured to acquire extended domain name data of multi-source domain name data, wherein the multi-source domain name data includes domain name data acquired from multiple channels;

[0118] A database generation module 904 is configured to generate a domain name preservation database according to the multi-source domain name data and the extended domain name data;

[0119] The resolution module 906 is configured to respond to the domain name resolution request based on the domain name preservation database when it is determined that the domain name service system fails.

[0120] In an exemplary embodiment, before obtaining the extended domain name data of the multi-source domain name data, it also includes: collecting basic domain name information based on active or passive methods to obtain first domain name data; obtaining second domain name data in at least one target scenario, the second domain name data including at least one of a CDN domain name, a reverse domain name, and a target top-level domain name; and standardizing the first domain name data and the second domain name data to obtain standardized multi-source domain name data.

[0121] In an exemplary embodiment, the step of obtaining extended domain name data of multi-source domain name data includes: performing domain name expansion according to the multi-source domain name data to obtain extended domain name data; performing domain name prediction according to the multi-source domain name data to obtain predicted domain name data; and obtaining at least one of the extended domain name data and the predicted domain name data as extended domain name data.

[0122] In an exemplary embodiment, the domain name expansion based on the multi-source domain name data to obtain the expanded domain name data includes at least one of the following: domain name expansion based on pattern recognition to obtain the expanded domain name data; acquiring attribute information of the multi-source domain name data, and expanding the domain name according to the correlation between the attribute information to obtain the expanded domain name data; clustering the multi-source domain name data to obtain a clustering result, and domain name expansion of the clustering result to obtain the expanded domain name data.

[0123] In an exemplary embodiment, performing domain name prediction based on the multi-source domain name data to obtain predicted domain name data includes: crawling page data based on the multi-source domain name data to obtain corpus information in the page data; constructing different types of knowledge bases based on the corpus information, and performing online learning on a pre-trained domain name prediction model based on the knowledge base to obtain a learned domain name prediction model; and using the learned domain name prediction model to generate a predicted domain name set for the multi-source domain name data to obtain predicted domain name data.

[0124] In an exemplary embodiment, generating a domain name preservation database based on the multi-source domain name data and the extended domain name data includes: cleaning and aggregating the multi-source domain name data and the extended domain name data to obtain a candidate domain name preservation database; verifying the authenticity of the candidate domain names in the candidate domain name preservation database to obtain target candidate domain names that pass the authenticity verification; and generating the domain name preservation database based on the target candidate domain names.

[0125] In an exemplary embodiment, responding to the domain name resolution request based on the domain name preservation database includes: loading the domain name preservation database into a recursive server or a cache, and using the recursive server or the cache to respond to the domain name resolution request.

[0126] In an exemplary embodiment, the response to the domain name resolution request based on the domain name preservation database includes: classifying and sorting the domain name data in the domain name preservation database based on preset topological attributes, and storing them in a red-black tree structure; for the domain name resolution request, determining the topological label corresponding to the domain name resolution request; searching for the resolution result corresponding to the domain name resolution request in the stored red-black tree structure according to the topological label; and returning the resolution result in response to the domain name resolution request.

[0127] In an exemplary embodiment, Fig.10 As shown, the above-mentioned domain name resolution device is further described below, which can specifically include a data acquisition module, a database generation module, a preservation module and a resolution module, wherein the data acquisition module collects domain name data based on different channels (such as active collection, passive collection, issuance by the competent unit, and obtained based on dialing measurement at a dialing measurement point, etc.) to obtain multi-source domain name data, and generates extended domain name data based on the multi-source domain name data, and the database generation module performs data cleaning and fusion according to the multi-source domain name data and the extended domain name data, and performs authenticity verification (such as verifying the authenticity of the domain name based on a response strategy, verifying the authenticity of the domain name based on a request strategy, etc.) to obtain a preservation data reference library (the library includes all domain names that have passed the authenticity verification), and then, when it is determined that the domain name service system fails, based on at least one of the domain name preservation strategies (such as CDN preservation, important domain name preservation, preservation based on email callback software, preservation based on website download on demand, etc.) or migration strategies (such as CDN migration, important domain name migration, etc.), the corresponding domain name data that needs to be preserved or migrated can be extracted from the preservation data reference library as a preservation library, and migrated to the resolution module to perform normal domain name resolution. This enables the provision of secure DNS resolution services in extreme situations, ensuring the availability of Internet services.

[0128] Each module in the above-mentioned domain name resolution device can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each module above.

[0129] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Fig.11 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store domain name data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a domain name resolution method is implemented.

[0130] Those skilled in the art will understand that Fig.11 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0131] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0132] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0133] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0134] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0135] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0136] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0137] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A domain name resolution method, characterized in that: The method comprises: Acquire extended domain name data of multi-source domain name data, wherein the multi-source domain name data includes domain name data acquired from multiple channels; Generate a domain name preservation database according to the multi-source domain name data and the extended domain name data; In the case where it is determined that the domain name service system fails, a domain name resolution request is responded to based on the domain name preservation database.

2. The method according to claim 1, characterized in that Before acquiring the extended domain name data of the multi-source domain name data, the method further includes: Collecting basic domain name information in an active or passive manner to obtain first domain name data; Acquire second domain name data in at least one target scenario, where the second domain name data includes at least one of a CDN domain name, a reverse domain name, and a target top-level domain name; The first domain name data and the second domain name data are standardized to obtain standardized multi-source domain name data.

3. The method according to claim 1, characterized in that The step of obtaining the extended domain name data of the multi-source domain name data includes: Expanding the domain name according to the multi-source domain name data to obtain expanded domain name data; Performing domain name prediction based on the multi-source domain name data to obtain predicted domain name data; At least one of the expanded domain name data and the predicted domain name data is obtained as the extended domain name data.

4. The method according to claim 3, characterized in that The performing domain name expansion according to the multi-source domain name data to obtain expanded domain name data includes at least one of the following: Performing domain name expansion on the multi-source domain name data based on pattern recognition to obtain expanded domain name data; Acquire attribute information of the multi-source domain name data, and expand the domain name according to the correlation between the attribute information to obtain expanded domain name data; The multi-source domain name data is clustered to obtain a clustering result, and the clustering result is subjected to domain name expansion to obtain expanded domain name data.

5. The method according to claim 3, characterized in that: The performing domain name prediction according to the multi-source domain name data to obtain predicted domain name data includes: Crawling page data according to the multi-source domain name data to obtain corpus information in the page data; Building different types of knowledge bases based on the corpus information, and performing online learning on a pre-trained domain name prediction model according to the knowledge base to obtain a learned domain name prediction model; The learned domain name prediction model is used to generate a predicted domain name set of the multi-source domain name data to obtain predicted domain name data.

6. The method according to claim 1, characterized in that The step of generating a domain name preservation database according to the multi-source domain name data and the extended domain name data includes: Cleaning and aggregating the multi-source domain name data and the extended domain name data to obtain a candidate domain name preservation database; Performing authenticity verification on the candidate domain names in the candidate domain name preservation database, and obtaining the target candidate domain names that have passed the authenticity verification; The domain name preservation database is generated based on the target candidate domain name.

7. The method according to any one of claims 1 to 6, characterized in that: The responding to the domain name resolution request based on the domain name preservation database includes: The domain name preservation database is loaded into a recursive server or a cache, and the recursive server or the cache is used to respond to the domain name resolution request.

8. The method according to any one of claims 1 to 6, characterized in that: The responding to the domain name resolution request based on the domain name preservation database includes: Classifying and sorting the domain name data in the domain name preservation database based on preset topological attributes, and storing them in a red-black tree structure; For the domain name resolution request, determine a topology label corresponding to the domain name resolution request; Searching for a resolution result corresponding to the domain name resolution request in the stored red-black tree structure according to the topology label; In response to the domain name resolution request, the resolution result is returned.

9. A domain name resolution device, characterized in that: The device comprises: A data acquisition module is configured to acquire extended domain name data of multi-source domain name data, wherein the multi-source domain name data includes domain name data acquired from multiple channels; A database generation module, configured to generate a domain name preservation database according to the multi-source domain name data and the extended domain name data; The resolution module is configured to respond to the domain name resolution request based on the domain name preservation database when it is determined that the domain name service system fails.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 8 are implemented.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

12. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images