Domain name abnormal behavior simulation method, device, computer equipment and storage medium

Abstract

The embodiments of the present application provide a method, apparatus, computer equipment, and storage medium for simulating abnormal behavior of a domain name. The method includes: in response to a domain name abnormal behavior simulation request, determining a target domain name that needs to be simulated for resolution; determining multiple real service nodes associated with the target domain name when performing domain name resolution in an Internet environment; using a container cluster manager, deploying simulation nodes corresponding to each real service node and each routing node, respectively, to construct a simulation node topology; obtaining node status data and generating a corresponding initial simulation environment; adjusting the corresponding object data in the initial simulation environment and converting it into a target simulation environment corresponding to the target environment type; obtaining any target subdomain contained in the target domain name and inputting it into the target simulation environment for simulation to obtain a simulation result of abnormal behavior of the domain name. In this way, the system stability can be maintained, and potential problems existing in the domain name system when responding to risks can be discovered and resolved in a timely manner.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a method, apparatus, computer equipment, and storage medium for simulating abnormal domain name behavior. Background Art

[0002] The Domain Name System (DNS) is a core service of the internet. Its role is to translate memorable domain names (such as www.example.com) into Internet Protocol addresses (such as 192.0.2.1) used by computers for network communication, ensuring smooth access to relevant websites. However, as the internet has become a vital platform for information exchange, DNS not only fulfills its domain name resolution function but also becomes a vulnerable target for network security attacks. This exposes the DNS to risks such as service outages, network outages, domain name disappearance and alteration, and domain name hijacking and alteration, rendering users unable to access websites or services through domain names.

[0003] To ensure system security and stability, the domain name system must be well-equipped to handle risks such as service outages, network outages, domain name disappearance and alteration, and domain name hijacking and alteration. Therefore, it's crucial to evaluate the domain name system's protection capabilities in different scenarios to facilitate subsequent repairs of weaknesses, thereby improving the system's overall security posture and reducing the risk of business interruptions caused by DNS attacks.

[0004] In related technologies, when evaluating the domain name system's protection capabilities in different scenarios, the assessment is generally based on the system's response after the system encounters an attack or interruption. For example, after a domain name hijacking or tampering occurs, the system's response during this period can be obtained and evaluated. However, this assessment method has a certain lag, which is not conducive to maintaining system stability and cannot promptly identify and resolve potential problems in the domain name system when responding to risks. Summary of the Invention

[0005] The main purpose of the embodiments of the present application is to propose a domain name abnormal behavior simulation method, device, computer equipment and storage medium, which can timely discover and solve potential problems existing in the domain name system when responding to risks while maintaining system stability.

[0006] To achieve the above objectives, a first aspect of an embodiment of the present application provides a method for simulating abnormal domain name behavior, the method comprising:

[0007] Responding to a domain name abnormal behavior simulation request, and determining a target domain name that needs to be parsed and simulated from the domain name abnormal behavior simulation request;

[0008] Determining multiple real service nodes associated with the target domain name when performing domain name resolution in an Internet environment, wherein the multiple real service nodes communicate with each other through their respective routing nodes;

[0009] Through the container cluster manager, deploy the simulation nodes corresponding to each real service node and each routing node respectively, so as to build a simulation node topology structure based on multiple simulation nodes;

[0010] Obtaining node status data of each real service node and each routing node in the Internet environment, and injecting each set of node status data into the simulation node corresponding to the simulation node topology structure to generate a corresponding initial simulation environment; wherein the target domain name corresponds to different Internet Protocol addresses in the Internet environment and the initial simulation environment respectively;

[0011] Determining a target environment type to be simulated in the initial simulation environment according to the domain name abnormal behavior simulation request, and adjusting corresponding object data in the initial simulation environment to convert the initial simulation environment into a target simulation environment corresponding to the target environment type;

[0012] Obtain any target subdomain contained in the target domain name, and input the target subdomain into the target simulation environment for simulation to obtain a domain name abnormal behavior simulation result.

[0013] Accordingly, a second aspect of the embodiments of the present application provides a device for simulating abnormal domain name behavior, the device comprising:

[0014] A response module, configured to respond to a domain name abnormal behavior simulation request and determine a target domain name that needs to be parsed and simulated from the domain name abnormal behavior simulation request;

[0015] a determination module, configured to determine a plurality of real service nodes associated with the target domain name when performing domain name resolution in an Internet environment, wherein the plurality of real service nodes communicate with each other through respective routing nodes;

[0016] A deployment module is used to deploy each real service node and each simulation node corresponding to the routing node through the container cluster manager, so as to build a simulation node topology structure according to the multiple simulation nodes;

[0017] a generation module configured to obtain node status data of each real service node and each routing node in the Internet environment, and inject each set of node status data into the simulation node corresponding to the simulation node topology structure to generate a corresponding initial simulation environment; wherein the target domain name corresponds to different Internet Protocol addresses in the Internet environment and the initial simulation environment respectively;

[0018] a conversion module, configured to determine a target environment type to be simulated in the initial simulation environment according to the domain name abnormal behavior simulation request, and adjust corresponding object data in the initial simulation environment to convert the initial simulation environment into a target simulation environment corresponding to the target environment type;

[0019] The simulation module is used to obtain any target subdomain contained in the target domain name, and input the target subdomain into the target simulation environment for simulation to obtain a simulation result of abnormal domain behavior.

[0020] In some embodiments, the types of the simulation nodes include at least a root domain simulation node, a recursive simulation node, a top-level domain simulation node, and an authoritative name simulation node, and the simulation module is further configured to:

[0021] Inputting the target subdomain into the target simulation environment, and determining a corresponding recursive simulation node from the target simulation environment according to the target subdomain;

[0022] Determine the root domain name simulation node corresponding to the target subdomain name through the recursive simulation node;

[0023] Acquire the top-level domain of the target subdomain, and transmit the first address of the top-level domain simulation node to the recursive simulation node based on the top-level domain through the root domain simulation node;

[0024] Accessing the top-level domain simulation node based on the first address through the recursive simulation node to obtain the authoritative name simulation node address of the target subdomain name;

[0025] Through the recursive simulation node, the authoritative name simulation node is accessed based on the authoritative name simulation node address, so that the authoritative name simulation node returns the domain name abnormal behavior simulation result corresponding to the target subdomain name by querying the subdomain name resolution record of the target subdomain name.

[0026] In some embodiments, the domain name abnormal behavior simulation device further includes an adjustment module for:

[0027] Inputting the target subdomain into the Internet environment to obtain a first Internet Protocol address corresponding to the target subdomain;

[0028] Comparing the domain name abnormal behavior simulation result with the first Internet Protocol address to obtain a comparison result;

[0029] When the comparison result indicates that the first Internet Protocol address is inconsistent with the domain name abnormal behavior simulation result, the attack and defense strategy parameters of the domain name system are adjusted.

[0030] In some implementations, the target environment type is service outage, the object data is an access control list, and the conversion module is further configured to:

[0031] In the initial simulation environment, determining a domain name resolution configuration module of the target domain name in a corresponding authoritative name simulation node;

[0032] Setting an access control list in the domain name resolution configuration module, and adding the Internet Protocol address segment where the recursive simulation node corresponding to the target domain name is located to the access control list to restrict the recursive simulation node from accessing the domain name resolution record stored in the authoritative name simulation node;

[0033] A target simulation environment corresponding to the target environment type is updated.

[0034] In some embodiments, the target environment type is network disconnection and service suspension, and the object data includes a restricted access list; the conversion module is further configured to:

[0035] In the initial simulation environment, determining a target routing node of the target domain name in the authoritative name simulation node;

[0036] Establishing a restricted access list in the routing configuration of the target routing node, and adding the Internet Protocol address segment where the recursive simulation node corresponding to the target domain name is located to the restricted access list to limit the traffic data sent by the recursive simulation node to the authoritative name simulation node;

[0037] A target simulation environment corresponding to the target environment type is updated.

[0038] In some embodiments, the target environment type is domain name disappearance and tampering, the object data includes a target zone file, and the conversion module is further configured to:

[0039] In the initial simulation environment, determining an authoritative name simulation node corresponding to the target domain name;

[0040] In the authoritative name simulation node, a target zone file is determined; wherein the target zone file is at least used to store a mapping relationship between the target domain name and the corresponding second Internet Protocol address;

[0041] Deleting the resource record corresponding to the target domain name in the target zone file;

[0042] A target simulation environment corresponding to the target environment type is updated.

[0043] In some embodiments, the target environment type is domain name hijacking and tampering, the object data includes a target zone file, and the conversion module is further configured to:

[0044] In the initial simulation environment, determining an authoritative name simulation node corresponding to the target domain name;

[0045] In the authoritative name simulation node, a target zone file is determined; wherein the target zone file is at least used to store a mapping relationship between the target domain name and the corresponding second Internet Protocol address;

[0046] In the target area file, the second Internet Protocol address is modified to a third Internet Protocol address; wherein the third Internet Protocol address points to an abnormal web page;

[0047] A target simulation environment corresponding to the target environment type is updated.

[0048] In some embodiments, the deployment module is further configured to:

[0049] Deploy, through a container cluster manager, a simulation node corresponding to each real service node and each routing node in at least one virtual server node;

[0050] Based on the border gateway protocol, network data is deployed for each simulation node corresponding to each routing node, and a simulation node topology structure is constructed according to the deployed multiple simulation nodes.

[0051] In some embodiments, the domain name abnormal behavior simulation device further includes a modification module for:

[0052] When there exists a first authoritative name simulation node associated with any first domain name when performing domain name resolution in the Internet environment, and the first authoritative name server node associated with the target domain name is the same, modifying the Internet Protocol address corresponding to the first domain name in the target simulation environment to a fourth Internet Protocol address;

[0053] Perform domain name abnormal behavior simulation on the first domain name to obtain a first domain name abnormal behavior simulation result corresponding to the first domain name.

[0054] Correspondingly, the third aspect of the embodiments of the present application proposes a computer device, which includes a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, it implements the domain name abnormal behavior simulation method described in any one of the embodiments of the first aspect of the present application.

[0055] Correspondingly, the fourth aspect of the embodiments of the present application proposes a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the domain name abnormal behavior simulation method of any one of the embodiments of the first aspect of the present application.

[0056] The embodiment of the present application responds to a domain name abnormal behavior simulation request and determines a target domain name that needs to be simulated for resolution from the domain name abnormal behavior simulation request; determines multiple real service nodes associated with the target domain name when performing domain name resolution in an Internet environment, and the multiple real service nodes communicate with each other through their respective routing nodes; through a container cluster manager, deploys simulation nodes corresponding to each real service node and each routing node respectively, so as to build a simulation node topology structure based on the multiple simulation nodes; obtains node status data of each real service node and each routing node in the Internet environment, and injects each set of node status data into the simulation node corresponding to the simulation node topology structure to generate a corresponding initial simulation environment; wherein the target domain name corresponds to different Internet Protocol addresses in the Internet environment and the initial simulation environment respectively; determines the target environment type to be simulated in the initial simulation environment according to the domain name abnormal behavior simulation request, and adjusts the corresponding object data in the initial simulation environment to convert the initial simulation environment into a target simulation environment corresponding to the target environment type; obtains any target subdomain contained in the target domain name, and inputs the target subdomain into the target simulation environment for simulation to obtain a domain name abnormal behavior simulation result. In this way, by constructing an initial simulation environment that is highly similar to the Internet environment in advance, it is possible to adjust the object data corresponding to different target environment types in the initial simulation environment under controlled conditions to simulate various risk behaviors that the domain name system may encounter, and test the response of the domain name system when facing various potential risks, thereby greatly shortening the time cycle from problem discovery to problem resolution, so as to timely discover weak links in the system and take measures to repair them before actual attacks occur, effectively improving the security and stability of the system, and ensuring that even in the face of complex network security threats, it can maintain good response capabilities. In summary, this application will not affect the actual Internet environment during the simulation process, and can timely discover and solve potential problems in the domain name system when responding to risks while maintaining system stability. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 This is a schematic diagram of the architecture of the domain name abnormal behavior simulation system provided by an embodiment of the present application;

[0058] Figure 2 This is a flowchart of the domain name abnormal behavior simulation method provided by an embodiment of the present application;

[0059] Figure 3 This is a simulation example diagram of a service outage provided in an embodiment of the present application;

[0060] Figure 4 This is a simulation example diagram of a network outage and service suspension provided in an embodiment of the present application;

[0061] Figure 5This is a simulation example diagram of a domain name disappearance and tampering provided by an embodiment of the present application;

[0062] Figure 6 This is a simulation example diagram of domain name hijacking and tampering provided by an embodiment of the present application;

[0063] Figure 7 This is a diagram of the overall processing process of the domain name abnormal behavior simulation method provided by an embodiment of the present application;

[0064] Figure 8 This is a schematic diagram of the functional modules of the domain name abnormal behavior simulation device provided by an embodiment of the present application;

[0065] Figure 9 This is a schematic diagram of the hardware structure of the computer device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0066] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0067] It should be noted that although the device schematics illustrate functional module divisions and the flowcharts illustrate logical sequences, in certain circumstances, the steps shown or described may be performed in a sequence that differs from the module divisions in the device or the sequence in the flowcharts. The terms "first," "second," and so on, in the specification, claims, and drawings, are used to distinguish similar items and are not necessarily used to describe a specific sequence or precedence.

[0068] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application pertains. The terms used herein are for the purpose of describing the embodiments of this application only and are not intended to limit this application.

[0069] The Domain Name System (DNS) is a core service of the internet. Its role is to translate memorable domain names (such as www.example.com) into Internet Protocol addresses (such as 192.0.2.1) used by computers for network communication, ensuring smooth access to relevant websites. However, as the internet has become a vital platform for information exchange, DNS not only fulfills its domain name resolution function but also becomes a vulnerable target for network security attacks. This exposes the DNS to risks such as service outages, network outages, domain name disappearance and alteration, and domain name hijacking and alteration, rendering users unable to access websites or services through domain names.

[0070] To ensure system security and stability, the domain name system must be well-equipped to handle risks such as service outages, network outages, domain name disappearance and alteration, and domain name hijacking and alteration. Therefore, it's crucial to evaluate the domain name system's protection capabilities in different scenarios to facilitate subsequent repairs of weaknesses, thereby improving the system's overall security posture and reducing the risk of business interruptions caused by DNS attacks.

[0071] In related technologies, when evaluating the domain name system's protection capabilities in different scenarios, the assessment is generally based on the system's response after the system encounters an attack or interruption. For example, after a domain name hijacking or tampering occurs, the system's response during this period can be obtained and evaluated. However, this assessment method has a certain lag, which is not conducive to maintaining system stability and cannot promptly identify and resolve potential problems in the domain name system when responding to risks.

[0072] Based on this, the embodiments of the present application provide a domain name abnormal behavior simulation method, device, computer equipment and storage medium, which can timely discover and solve potential problems in the domain name system when responding to risks while maintaining system stability.

[0073] The domain name abnormal behavior simulation method, device, computer equipment and storage medium provided in the embodiments of the present application are specifically illustrated through the following embodiments. First, the domain name abnormal behavior simulation system in the embodiments of the present application is described.

[0074] Please refer to Figure 1 In some implementations, an embodiment of the present application provides a domain name abnormal behavior simulation system, including a network simulation module, a system simulation module, a simulation console, a simulation status perception module, and a simulation visualization module.

[0075] For example, the network simulation module uses open-source tools that support the Border Gateway Protocol (BGP) to deploy a virtual routing network environment, build interconnected routing nodes through BGP, and use a container cluster manager (Kubernetes, K8S) and containerization technology to implement containerized node deployment. The network simulation module supports collecting BGP data from the internet environment and dynamically generates virtual network routing configurations to achieve network simulation (simulation is simulation).

[0076] Furthermore, the system simulation module mainly realizes the simulation of the domain name system, and uses the domain name system service software to realize the simulation of multiple real service nodes associated with the execution of domain name resolution. The system simulation module can analyze the target domain name to be simulated based on the domain name abnormal behavior simulation request, and obtain the data of all upstream resolved real service nodes required for the target domain name from the actual Internet environment and cache it, so as to provide domain name abnormal behavior simulation results consistent with the Internet in the simulation environment. At the same time, according to the real service node where the specified risk occurs, the principle of minimization of simulation is adopted, and only the object data related to the target environment type is modified. The other resolution parts still use the target domain name service in the Internet environment. Therefore, in addition to analyzing and obtaining the data of the real service nodes in the Internet environment, the system simulation module also determines the range of the simulated domain name nodes based on the location analysis of the risk occurrence domain, and determines the boundary between the target simulation environment and the Internet environment to minimize simulation resources.

[0077] Furthermore, the simulation console is responsible for receiving and routing domain name abnormal behavior simulation requests, controlling the execution of the network simulation module and the system simulation module, issuing instructions to the simulation status perception module to perform detection tasks, and the simulation perception module feeds back the domain name abnormal behavior simulation results to the simulation console, and based on the domain name abnormal behavior simulation results, issues visualization result instructions to the simulation visualization module.

[0078] Among them, the simulation status perception module can monitor the network and system simulation status of the target simulation environment, collect the network and system status data of the simulation environment, and feedback the simulation results of abnormal domain name behavior to the simulation console, and provide visual basic environment data for the simulation visualization module.

[0079] The simulation visualization module can query the simulation state perception module for environmental data during the simulation process according to the instructions of the simulation console, and visualize the data.

[0080] In some embodiments, the domain name abnormal behavior simulation system can be installed on a computer device, which can be a local server, a cloud server, a private cloud environment, a virtual machine, a container cluster, a high-performance computing cluster, etc. The specific installation environment can be selected based on the system's performance requirements, security requirements, cost-effectiveness, and convenience of maintenance and support.

[0081] The domain name abnormal behavior simulation method in the embodiment of the present application can be illustrated by the following embodiment.

[0082] It should be noted that in each specific embodiment of the present application, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first. Moreover, the collection, use, and processing of these data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present application will be obtained.

[0083] In the embodiment of the present application, the domain name abnormal behavior simulation device will be described from the perspective of the domain name abnormal behavior simulation device, which can be integrated into a computer device. Figure 2 , Figure 2 This is a flowchart of the steps of the domain name abnormal behavior simulation method provided in an embodiment of the present application. In this embodiment of the present application, the domain name abnormal behavior simulation device is specifically integrated into a terminal or server as an example. When the processor on the terminal or server executes the program instructions corresponding to the domain name abnormal behavior simulation method, the specific process is as follows:

[0084] Step 101: respond to a domain name abnormal behavior simulation request and determine a target domain name that needs to be simulated for resolution from the domain name abnormal behavior simulation request.

[0085] In some implementations, in order to study and test the behavior of the domain name system when facing various security risks, the target domain name to be simulated can be determined based on the domain name abnormal behavior simulation request, so that an accurate simulation scenario can be constructed for the target domain name through the simulation platform.

[0086] Among them, the domain name abnormal behavior simulation request can be a simulation request submitted by the terminal when it is necessary to test the performance of the system when the target domain name is affected by abnormal behavior in the network. The domain name abnormal behavior simulation request can include the target domain name, target environment type and other relevant parameters.

[0087] The target domain name can be the specific domain name where the simulated risk is expected to occur. For example, if a user wants to test how example.com responds to a service outage or hijacking, then example.com is the target domain name.

[0088] Exemplarily, the domain name abnormal behavior simulation request may be manually initiated by a security analyst, or may be automatically generated by an automated system based on predefined rules or detected abnormal activities.

[0089] In some implementations, domain names with higher risk scores, belonging to key business services, or associated with known threats can be prioritized, and a domain name abnormal behavior simulation request can be generated. The system can respond to the domain name abnormal behavior simulation request and parse the domain name abnormal behavior simulation request to obtain the target domain name and the target environment type to be simulated. In this way, it is possible to effectively focus on high-risk areas, reduce the possibility of service interruption due to network attacks, and improve the effectiveness and pertinence of security protection. Alternatively, the target domain name can be selected based on actual conditions, and this embodiment of the application does not impose specific restrictions on this.

[0090] By identifying the target domain name, you can effectively simulate abnormal domain behavior, thereby better understanding and responding to potential security threats.

[0091] Step 102: Determine multiple real service nodes associated with the target domain name when performing domain name resolution in the Internet environment. The multiple real service nodes communicate with each other through their respective routing nodes.

[0092] In some embodiments, in order to prepare for subsequent risk simulation and ensure that the simulation environment can faithfully reproduce the real resolution process, multiple real service nodes associated with the target domain name when performing domain name resolution in the Internet environment can be determined to support users to specify risks at any position in the resolution chain for simulation, enhance the authenticity of the simulation, and enable researchers to evaluate the security and stability of domain name resolution under conditions close to reality.

[0093] The Internet environment can be a real-world network, which is a large-scale distributed system consisting of countless networks connected together, allowing computers in different geographical locations to communicate with each other. In the Internet environment, domain name resolution can convert domain names into machine-readable Internet Protocol (IP) addresses.

[0094] The real service node may be a server node that actually exists in the Internet environment and resolves the target domain name into an Internet Protocol address.

[0095] The routing node may be a device or system used to forward data packets of an associated real service node on the Internet, and may determine the best path to send information based on a routing table.

[0096] Exemplarily, the real service node includes but is not limited to a root server, a top-level domain server, an authoritative name server, a recursive server, etc. used in the target domain name resolution process in an Internet environment.

[0097] Furthermore, all domain names that are relied upon during the resolution process of the target domain name can be queried and resolved to obtain complete domain name resolution dependency data, thereby determining the multiple real service nodes associated with performing domain name resolution. For example, in an Internet environment, when a user enters the target domain name www.example.com in the terminal's browser and attempts to access it, the user's Internet service provider's recursive server begins processing the access request. The recursive server can query the root server, which instructs the recursive server to query the top-level domain server of ".com". The top-level domain server will instruct the recursive server to query the authoritative name server of example.com. After the recursive server queries the authoritative name server of example.com, it can obtain the specific Internet Protocol address information of www.example.com. Based on the above domain name resolution dependency data, it can be determined that the multiple real service nodes associated with performing domain name resolution include the corresponding recursive server, root server, top-level domain server, and authoritative name server.

[0098] For example, a routing node can be a router, switch, or other network device with routing capabilities. During the domain name resolution process, the routing node ensures that domain name resolution queries initiated by a terminal correctly reach the corresponding real service node and that responses are successfully returned to the terminal. Routing nodes can communicate with each other via the Border Gateway Protocol and dynamically update routing information to ensure efficient and reliable communication.

[0099] By determining the multiple real service nodes associated with the target domain name when performing domain name resolution in the Internet environment, as well as the routing nodes associated with each real service node, we can prepare for subsequent risk simulation and enhance the authenticity of the simulation.

[0100] Step 103: Deploy each real service node and each routing node corresponding to a simulation node through a container cluster manager, so as to construct a simulation node topology structure according to the plurality of simulation nodes.

[0101] In some embodiments, in order to create a resource-saving, efficient, flexible and realistic target simulation environment, that is, a risk simulation environment, simulation nodes can be deployed by using a container cluster manager and a simulation node topology can be constructed to ensure the accuracy, scalability and resource utilization of the simulation.

[0102] Among them, the container cluster manager (Kubernetes, K8S) can be a platform for automating the deployment, management, and expansion of containerized applications.

[0103] The simulation node may be a virtual node created for simulation, and the simulation node may be used to simulate a real service node or routing node that performs a specific function in a real Internet environment.

[0104] The simulation node topology structure may be the connection mode and interaction mode between all simulation nodes.

[0105] For example, a container cluster manager can be used to create corresponding container (Docker) images for each real service node and routing node, and a Kubernetes Deployment file can be written for each node to define the image, resource restrictions, environment variables, etc. of the required container. A Kubernetes Service file can be written for each node to define the service type, port mapping, etc., and the Kubernetes Deployment file and Kubernetes Service file can be applied to the K8S cluster respectively.

[0106] Furthermore, within a BGP-supported container, you can configure the BGP, set neighbor nodes, and configure routing policies. Routing data can then be collected from the internet environment for the simulated nodes corresponding to each routing node to dynamically generate routing configurations for the simulation environment. After generating all real service nodes and simulated nodes corresponding to all routing nodes, you can perform tests to verify the connectivity, correctness, and validity of each simulated node.

[0107] By constructing a simulation node topology, all key links involved in a specific domain name resolution process can be accurately simulated, including possible risk locations, providing a foundation for the subsequent construction of the initial simulation environment.

[0108] In some implementations, to ensure that the simulation environment is both realistic and scalable and flexible, a container cluster manager can be used to deploy virtual server nodes and a simulation node topology can be constructed based on the Border Gateway Protocol to improve the realism of the simulation environment while saving system resources. For example, step 103 may include:

[0109] (103.1) Deploy, using a container cluster manager, a simulation node corresponding to each real service node and each routing node in at least one virtual server node;

[0110] (103.2) Based on the border gateway protocol, network data is deployed for each simulation node corresponding to each routing node, and a simulation node topology structure is constructed based on the deployed multiple simulation nodes.

[0111] Among them, the virtual server node can be a virtual machine running on a physical server or cluster through virtualization software. The virtual server node can simulate the behavior of a real server and can be quickly deployed, configured and expanded as needed.

[0112] The Border Gateway Protocol (BGP) is a standard protocol used on the Internet to exchange routing information between autonomous systems. It can be used to determine the optimal path for data packets corresponding to each real service node to travel between networks, ensuring reliable communication between different networks.

[0113] For example, you can install a K8S cluster on at least one virtual server node, write a Dockerfile for each real service node using BIND9, and build an image; write a Dockerfile for each routing node using GoBGP, and build an image. The Go in GoBGP stands for the Go language, and BGP stands for Border Gateway Protocol.

[0114] Furthermore, you can write Deployment and Service YAML configuration files for each real service node and routing node respectively, define the container image, resource limits, service ports, etc., and apply the YAML configuration files to the K8S cluster to deploy the simulation nodes.

[0115] Furthermore, GoBGP can be configured in the Docker container of each routing node, BGP neighbor relationships and routing policies can be set, and network data can be collected from the Internet environment. The routing configuration of the initial simulation environment can be dynamically generated based on the collected network data. Then, a simulation node topology structure can be constructed based on multiple simulation nodes corresponding to real service nodes and routing nodes.

[0116] By constructing a simulated node topology, we can dynamically generate virtual network routing configurations, enabling the simulation environment to reflect the service data of the Internet environment in real time. Simultaneously, by only simulating the nodes related to the domain name resolution, we can effectively reduce the resources required for simulation.

[0117] Step 104: Obtain node status data of each real service node and each routing node in the Internet environment, and inject each set of node status data into the simulation node corresponding to the simulation node topology structure to generate a corresponding initial simulation environment; wherein the target domain name corresponds to different Internet Protocol addresses in the Internet environment and the initial simulation environment, respectively.

[0118] In some embodiments, in order to ensure that the simulation node matches the behavior and configuration of the real node in the initial state, the node status data of the real service node and routing node in the current Internet environment can be obtained, and the node status data can be injected into the corresponding simulation node to generate an initial simulation environment similar to the real environment, so as to establish the foundation of a reliable simulation environment and improve the security and stability of the network.

[0119] The node status data may be a collection of information describing the current operating status of each real service node (such as a recursive resolver, an authoritative name server, etc.) and routing node in the Internet environment.

[0120] The initial simulation environment can be a virtualized environment in its initial state, constructed on a simulation platform based on collected state data of various nodes in a real Internet environment. The initial simulation environment is designed to closely mimic the behavior of the real Internet while allowing operators to control and observe the domain name resolution process under specific conditions.

[0121] In some embodiments, different Internet Protocol addresses can be assigned to the target domain name in the initial simulation environment to avoid address conflicts with the real network environment. In addition, the initial simulation environment is allowed to run independently of the real Internet environment, avoiding potential impact on the Internet environment.

[0122] For example, the node status data of each real service node and each routing node can be obtained from the Internet environment through network detection, API calls, database queries, etc. For example, for real service nodes, the node status data may include server configuration information, zone files, performance indicators, health status, resolution records, etc.; for routing nodes, the node status data may include routing tables, BGP session information, routing policies, etc.

[0123] Furthermore, when injecting node status data into the corresponding simulation node, for the simulation node corresponding to the server node, it can include configuring the regional file of the simulation node, etc.; for the simulation node corresponding to the routing node, it can include configuring the routing table and BGP policy of the simulation node, etc., thereby generating the corresponding initial simulation environment.

[0124] By generating an initial simulation environment, a highly simulated initial simulation environment can be constructed, which can accurately simulate the behavior patterns of the real Internet. In this way, while avoiding address conflicts with the real network, it can ensure that the initial simulation environment can run independently, thereby improving the controllability and observability of the domain name resolution process, and providing a safe and flexible experimental platform for studying and testing the risk management of the domain name system.

[0125] Step 105 : determining the target environment type to be simulated in the initial simulation environment according to the domain name abnormal behavior simulation request, and adjusting the corresponding object data in the initial simulation environment to convert the initial simulation environment into a target simulation environment corresponding to the target environment type.

[0126] In some embodiments, in order to accurately simulate a specific type of abnormal behavior of a domain name, a target simulation environment close to the real scenario can be created by determining the target environment type and adjusting the corresponding object data in the initial simulation environment, so as to provide a solid foundation for risk assessment, protection strategy testing, etc. without affecting actual Internet services.

[0127] Among them, the target environment type can be a simulation scenario category determined based on the domain name abnormal behavior simulation request submitted by the user, which reflects the specific risks or abnormal situations that the user wants to simulate, such as service suspension, network disconnection, disappearance, hijacking, etc.

[0128] The object data may be an object of simulation adjustment, and is used to determine a target environment type of a target simulation environment.

[0129] The target simulation environment can be the final simulation state, based on the initial simulation environment and specifically adjusted according to the domain name abnormal behavior simulation request. The target simulation environment can reproduce the risk scenario specified by the user (i.e., the target environment type), allowing researchers to observe and analyze abnormal behavior during the domain name resolution process under controlled conditions.

[0130] For example, when the target environment type is a service outage, the object data can be the access control list of the BIND configuration file in the domain name resolution configuration module. In the access control list, access to the Internet Protocol address corresponding to the target domain name during the resolution process is restricted, thereby simulating a service outage scenario. Similarly, when the target environment type is a network outage, domain name disappearance and tampering, domain name hijacking and tampering, etc., the corresponding object data can also be modified to convert the initial simulation environment without risk into the target simulation environment corresponding to the target environment type.

[0131] By modifying the object data and converting the initial simulation environment into a target simulation environment corresponding to the target environment type, we can conduct in-depth research on the various risks in the domain name resolution process in a safe and controllable environment and develop effective countermeasures without worrying about any impact on actual Internet services. This not only improves the accuracy of the simulation, but also enhances security and controllability, helping to more comprehensively understand the risks of domain name resolution and formulate reasonable defense strategies.

[0132] In some implementations, to determine the impact of a service outage on the system and evaluate the domain name resolution system's response to a service outage, a service outage can be simulated in an initial simulation environment to accurately simulate and study the risk of service outages during domain name resolution without affecting the actual Internet environment. For example, when the target environment type is a service outage and the object data is an access control list, step 105 of "adjusting the corresponding object data in the initial simulation environment to convert the initial simulation environment into a target simulation environment corresponding to the target environment type" may include:

[0133] (105.a1) In the initial simulation environment, determine the domain name resolution configuration module of the target domain name in the corresponding authoritative name simulation node;

[0134] (105.a2) Setting an access control list in the domain name resolution configuration module and adding the Internet Protocol address segment of the recursive simulation node corresponding to the target domain name to the access control list to restrict the recursive simulation node from accessing the domain name resolution records stored in the authoritative name simulation node;

[0135] (105.a3) Update the target simulation environment corresponding to the target environment type.

[0136] The service suspension may be a situation where the domain name resolution service temporarily or permanently stops providing services to the outside world, that is, simulating a situation where one or more domain name resolution services are temporarily unavailable when resolving the target domain name.

[0137] An Access Control List (ACL) is a network security mechanism used to control access rights to specific resources. By configuring an ACL, access restrictions can be implemented on specific Internet Protocol address segments, thereby simulating the effect of a service outage.

[0138] The domain name resolution configuration module may be a software component responsible for managing domain name resolution rules and configurations. In an authoritative name server, the domain name resolution configuration module may be a domain name system software, such as Berkeley Internet Name Domain (BIND).

[0139] The authoritative name simulation node may be a virtual node that simulates an authoritative name server in a simulation environment. The authoritative name server is a server responsible for storing and providing specific domain name resolution records.

[0140] Please refer to Figure 3For example, when the target environment type received by the system is service shutdown, since the authoritative name simulation node is responsible for storing and providing resolution records of the target domain name (such as www.example.com), the authoritative name simulation node corresponding to the target domain name can be determined in the initial simulation environment.

[0141] Furthermore, in the initial simulation environment, the domain name resolution configuration module (such as the BIND configuration) of the authoritative name simulation node can be modified to add permission configuration to the access control list, restricting the access rights to the Internet Protocol address segment where the simulation recursive node corresponding to the target domain name is located, and updating the target simulation environment corresponding to the target environment type. In this way, when the recursive simulation node corresponding to the target domain name attempts to obtain the corresponding Internet Protocol address from the authoritative name simulation node, the authoritative name simulation node will return a resolution service failure status, such as a SERVFAIL status.

[0142] Through the above method, the access to the domain name resolution record by the IP end where the recursive simulation node of the target domain name is located can be accurately restricted, so that the system can accurately simulate the real situation where one or more domain name resolution services are unavailable, which is conducive to accurately testing the system's response ability to service outages without affecting the Internet environment.

[0143] In some embodiments, in order to determine the impact of network outages on the system and evaluate the response of the domain name resolution system to network outages, network outages can be simulated in an initial simulation environment to accurately simulate and study the risks of network outages during the domain name resolution process without affecting the actual Internet environment. For example, when the target environment type is network outages and the object data includes a restricted access list, the "adjusting the corresponding object data in the initial simulation environment to convert the initial simulation environment into a target simulation environment corresponding to the target environment type" in step 105 may also include:

[0144] (105.b1) In the initial simulation environment, determine the target routing node of the target domain name in the authoritative name simulation node;

[0145] (105.b2) Establishing a restricted access list in the routing configuration of the target routing node, and adding the Internet Protocol address segment of the recursive simulation node corresponding to the target domain name to the restricted access list to limit the traffic data sent by the recursive simulation node to the authoritative name simulation node;

[0146] (105.b3) Update the target simulation environment corresponding to the target environment type.

[0147] Among them, network outage and service suspension may be a situation where the network connection is interrupted, resulting in the inability to access the domain name resolution service normally. Network outage and service suspension may be caused by network failure, routing error or other reasons.

[0148] The restricted access list may be a routing configuration for discarding data traffic of the second Internet Protocol address corresponding to the target domain name, or the Internet Protocol address segment of the recursive simulation node corresponding to the target domain name without any processing or forwarding.

[0149] The target routing node may be a routing simulation node responsible for processing traffic of a specific target network segment in a simulation environment, and is used to forward data packets.

[0150] The target network segment may be the Internet Protocol address range corresponding to the target domain name, or the target network segment may be the Internet Protocol address segment where the recursive simulation node corresponding to the target domain name is located, which is an object with restricted access in the simulated target environment type.

[0151] Please refer to Figure 4 For example, when the target environment type received by the system is network disconnection and service suspension, since the authoritative name simulation node is responsible for storing and providing resolution records of the target domain name (such as www.example.com), the authoritative name simulation node corresponding to the target domain name can be determined in the initial simulation environment.

[0152] Furthermore, in the initial simulation environment, a restricted access list can be established in the routing configuration of the routing simulation node associated with the authoritative name simulation node, and the Internet Protocol address segment where the recursive simulation node corresponding to the target domain name is located is added to the access restriction list. In this way, all traffic sent to the authoritative name simulation node through the Internet Protocol address segment will be discarded, simulating the effect of network disconnection, and the initial simulation environment will be updated to obtain the target simulation environment corresponding to the target environment type.

[0153] Furthermore, when the recursive simulation node corresponding to the target domain name attempts to obtain the corresponding Internet Protocol address from the authoritative name simulation node, since the second Internet Protocol address corresponding to the target domain name is added to the restricted access list, the authoritative name simulation node will return a resolution service failure status, such as a SERVFAIL status.

[0154] By simulating the risk of network outages and service suspension in a simulated environment, we can accurately reproduce the situation where the domain name resolution service cannot be accessed normally due to network connection interruption. This is conducive to accurately testing the system's ability to respond to network outages and service suspension without affecting the Internet environment.

[0155] In some embodiments, in order to determine the impact of domain name disappearance and tampering on the system and evaluate the response of the domain name resolution system to domain name disappearance and tampering, domain name disappearance and tampering can be simulated in an initial simulation environment to accurately simulate and study the risk of domain name disappearance and tampering in the domain name resolution process without affecting the actual Internet environment. For example, when the target environment type is domain name disappearance and tampering, and the object data includes a target zone file, the "adjusting the corresponding object data in the initial simulation environment to convert the initial simulation environment into a target simulation environment corresponding to the target environment type" in step 105 can also include:

[0156] (105.c1) In the initial simulation environment, determine the authoritative name simulation node corresponding to the target domain name;

[0157] (105.c2) In the authoritative name simulation node, determining a target zone file; wherein the target zone file is used to store at least a mapping relationship between the target domain name and the corresponding second Internet Protocol address;

[0158] (105.c3) In the target zone file, delete the resource record corresponding to the target domain name;

[0159] (105.c4) Update the target simulation environment corresponding to the target environment type.

[0160] The disappearance and tampering of a domain name may be a situation where the resource record of the target domain name on the authoritative name server is deleted or tampered with, thereby making the domain name unable to be resolved normally.

[0161] The target zone file may be a file that stores a specific domain name and its corresponding resource records. In the domain name system, each domain name has a corresponding zone file that stores all resource records for that domain name. Exemplarily, the target zone file is used to store at least a mapping between the target domain name and the corresponding second Internet Protocol address.

[0162] A resource record is a data structure in the domain name system that describes the mapping between a domain name and related network information. For example, a resource record may include an A record (IPv4 address), an AAAA record (IPv6 address), an MX record (mail exchange server), etc.

[0163] Please refer to Figure 5 For example, when the target environment type received by the system is domain name disappearance and tampering, since the authoritative name simulation node is responsible for storing and providing resolution records of the target domain name (www.example.com), the authoritative name simulation node corresponding to the target domain name can be determined in the initial simulation environment.

[0164] Furthermore, a target zone file may be determined in the authoritative name simulation node, where the target zone file includes a mapping relationship between the target domain name (www.example.com) and its corresponding second Internet Protocol address (93.184.216.34).

[0165] Further, the resource record corresponding to the target domain name can be determined from the target zone file and deleted so that the target domain name no longer points to any Internet Protocol address. Afterwards, the simulation environment can be updated to obtain the target simulation environment corresponding to the target environment type.

[0166] Therefore, when a user tries to resolve www.example.com, since the resource record corresponding to the target domain name has been deleted, the authoritative name simulation node will return a status that the resolved domain name record does not exist, that is, it returns the NXDOMAIN status.

[0167] Through the above methods, the risk scenarios of domain name disappearance and tampering can be accurately simulated without affecting the real Internet environment, so as to test the performance of the system when key information is lost or tampered with, thereby improving the system's security and ability to respond to emergencies.

[0168] In some embodiments, in order to determine the impact of domain name hijacking and tampering on the system and evaluate the response of the domain name resolution system to domain name hijacking and tampering, domain name hijacking and tampering can be simulated in an initial simulation environment to accurately simulate and study the risk of domain name hijacking and tampering during the domain name resolution process without affecting the actual Internet environment. For example, when the target environment type is domain name hijacking and tampering, and the object data includes a target zone file, the "adjusting the corresponding object data in the initial simulation environment to convert the initial simulation environment into a target simulation environment corresponding to the target environment type" in step 105 may also include:

[0169] (105.d1) In the initial simulation environment, determine the authoritative name simulation node corresponding to the target domain name;

[0170] (105.d2) In the authoritative name simulation node, determining a target zone file; wherein the target zone file is used to store at least a mapping relationship between the target domain name and the corresponding second Internet Protocol address;

[0171] (105.d3) In the target area file, the second Internet Protocol address is modified to a third Internet Protocol address; wherein the third Internet Protocol address points to the abnormal web page;

[0172] (105.d4) Update the target simulation environment corresponding to the target environment type.

[0173] Domain name hijacking and tampering refers to the process in which the resource records of the target domain name on the authoritative name server are tampered with due to some reasons (such as configuration errors, malicious attacks, etc.), causing the domain name to point to an abnormal web page or malicious site. It simulates the process of malicious actors tampering with domain name resolution results and directing legitimate users to fake or malicious websites.

[0174] Among them, the third Internet Protocol address can be a new Internet Protocol address used to replace the real Internet Protocol address corresponding to the original target domain name. The third Internet Protocol address can point to an abnormal web page or malicious site to simulate the effect of domain name hijacking and tampering.

[0175] Please refer to Figure 6 For example, when the target environment type received by the system is domain name hijacking and tampering, since the authoritative name simulation node is responsible for storing and providing the resolution record of the target domain name (www.example.com), the authoritative name simulation node corresponding to the target domain name can be determined in the initial simulation environment.

[0176] Furthermore, a target zone file may be determined in the authoritative name simulation node, where the target zone file includes a mapping relationship between the target domain name (www.example.com) and its corresponding second Internet Protocol address (93.184.216.34).

[0177] Furthermore, the resource record corresponding to the target domain name can be determined from the target zone file, and the second Internet Protocol address (93.184.216.34) can be modified to a third Internet Protocol address (e.g., 192.168.1.1), which points to the abnormal web page. After that, the simulation environment can be updated to obtain the target simulation environment corresponding to the target environment type.

[0178] Therefore, when a user tries to resolve www.example.com, since the resource record corresponding to the target domain name has been tampered with, the authoritative name simulation node will return a hijacking error prompt page, indicating that the target domain name has been hijacked.

[0179] Through the above methods, the risk scenarios of domain name hijacking and tampering can be accurately simulated without affecting the real Internet environment, so as to test the performance of the system when it is tampered with, thereby improving the system's security and ability to respond to emergencies.

[0180] Step 106 , obtaining any target subdomain contained in the target domain name, and inputting the target subdomain into the target simulation environment for simulation, to obtain a simulation result of abnormal behavior of the domain name.

[0181] In some implementations, in order to further simulate and test specific risk scenarios, after building a general simulation environment based on the target domain name, the target subdomain of the target domain name can be input for further testing to perform a more detailed simulation.

[0182] The target subdomain can refer to any one or more subdomains of the target domain. For example, if the target domain is example.com, its subdomains could be www.example.com, mail.example.com, and so on. Each target subdomain may correspond to a different Internet Protocol address and service. Therefore, simulating abnormal behavior of the target subdomain can help to gain a more comprehensive understanding of the security status of the entire domain name system.

[0183] The domain name abnormal behavior simulation result may be the result data obtained after performing abnormal behavior simulation on the target domain name (including its target subdomains) in a simulation environment. The domain name abnormal behavior simulation result includes but is not limited to the domain name system response status, such as resolution service failure, domain name does not exist, etc.

[0184] In some implementations, building a target simulation environment based on a target domain name can reduce the number of subdomains that need to be configured and managed. This eliminates the need to create separate simulation instances for each target subdomain, thereby simplifying simulation setup, conserving simulation resources, and improving simulation efficiency. Therefore, after building a target simulation environment corresponding to the target environment type based on the target domain name, any target subdomain contained within the target domain name can be entered into the target simulation environment to obtain a simulation result of abnormal domain behavior.

[0185] The embodiment of the present application responds to a domain name abnormal behavior simulation request and determines a target domain name that needs to be simulated for resolution from the domain name abnormal behavior simulation request; determines multiple real service nodes associated with the target domain name when performing domain name resolution in an Internet environment, and the multiple real service nodes communicate with each other through their respective routing nodes; through a container cluster manager, deploys simulation nodes corresponding to each real service node and each routing node respectively, so as to build a simulation node topology structure based on the multiple simulation nodes; obtains node status data of each real service node and each routing node in the Internet environment, and injects each set of node status data into the simulation node corresponding to the simulation node topology structure to generate a corresponding initial simulation environment; wherein the target domain name corresponds to different Internet Protocol addresses in the Internet environment and the initial simulation environment respectively; determines the target environment type to be simulated in the initial simulation environment according to the domain name abnormal behavior simulation request, and adjusts the corresponding object data in the initial simulation environment to convert the initial simulation environment into a target simulation environment corresponding to the target environment type; obtains any target subdomain contained in the target domain name, and inputs the target subdomain into the target simulation environment for simulation to obtain a domain name abnormal behavior simulation result. In this way, by constructing an initial simulation environment that is highly similar to the Internet environment in advance, it is possible to adjust the object data corresponding to different target environment types in the initial simulation environment under controlled conditions to simulate various risk behaviors that the domain name system may encounter, and test the response of the domain name system when facing various potential risks, thereby greatly shortening the time cycle from problem discovery to problem resolution, so as to timely discover weak links in the system and take measures to repair them before actual attacks occur, effectively improving the security and stability of the system, and ensuring that even in the face of complex network security threats, it can maintain good response capabilities. In summary, this application will not affect the actual Internet environment during the simulation process, and can timely discover and solve potential problems in the domain name system when responding to risks while maintaining system stability.

[0186] In some embodiments, in order to simulate the entire process of domain name resolution in the target simulation environment, queries can be performed through corresponding simulation nodes, ultimately obtaining simulation results of abnormal domain name behavior, so as to safely test and evaluate various defense strategies and countermeasures, ensuring that potential security risks can be effectively addressed. Exemplarily, the types of simulation nodes include at least root domain name simulation nodes, recursive simulation nodes, top-level domain simulation nodes, and authoritative name simulation nodes. Step 106 of "inputting the target subdomain name into the target simulation environment for simulation to obtain simulation results of abnormal domain name behavior" may include:

[0187] (106.1) Inputting the target subdomain into the target simulation environment, and determining the corresponding recursive simulation node in the target simulation environment based on the target subdomain;

[0188] (106.2) Determine the root domain name simulation node corresponding to the target subdomain name by recursively simulating the node;

[0189] (106.3) Obtain the top-level domain of the target subdomain, and transmit the first address of the top-level domain simulation node to the recursive simulation node based on the top-level domain through the root domain simulation node;

[0190] (106.4) Accessing the top-level domain simulation node based on the first address through the recursive simulation node to obtain the authoritative name simulation node address of the target subdomain;

[0191] (106.5) Access the authoritative name simulation node based on the authoritative name simulation node address through the recursive simulation node, so that the authoritative name simulation node returns the domain name abnormal behavior simulation result corresponding to the target subdomain name by querying the subdomain name resolution record of the target subdomain name.

[0192] Among them, the root domain name simulation node can be a virtual node used to simulate the root domain name server function in the target simulation environment. The root domain name server is the highest-level server in the domain name system, responsible for responding to query requests for top-level domain names (such as ".com", ".org", etc.).

[0193] The recursive simulation node may be a virtual node that simulates the recursive domain name system resolver function in the target simulation environment, and is used to execute a complete domain name system query process in the target simulation environment and return the final result to the module that initiated the query.

[0194] A TLD emulation node is a virtual node that simulates the server functionality of a specific TLD within the target emulation environment. Each TLD emulation node is responsible for storing and providing authoritative information related to a specific TLD, such as ".com" or ".net." It can receive queries from recursive emulation nodes and direct them to a specific authoritative name emulation node.

[0195] The authoritative name emulation node can be a virtual node that simulates the functions of an authoritative server within the target emulation environment. It is responsible for storing and providing resolution records for the target domain name and its subdomains. When receiving a query request for a domain name within its management scope, the authoritative name emulation node directly returns the corresponding Internet Protocol address.

[0196] The first address may be an Internet Protocol address or other network identifier of a top-level domain simulation node, and is used for the recursive simulation node to access the top-level domain simulation node.

[0197] The authoritative name simulation node address may be an Internet Protocol address or other network identifier of the authoritative name simulation node, which is used for the recursive simulation node to access the authoritative name simulation node.

[0198] The subdomain name resolution record may be a resource record stored in an authoritative name simulation node, and is used to describe a mapping relationship between a target subdomain name and a corresponding Internet Protocol address.

[0199] For example, if the target subdomain is www.example.com, and you need to test the target simulation environment's response to a domain hijacking or tampering, you can enter the target subdomain in the simulation console. Furthermore, after receiving the simulation request, the target simulation environment can determine the corresponding recursive simulation node. If the Internet Protocol address of the recursive simulation node is 192.168.1.5.

[0200] Furthermore, after the recursive simulation node starts the resolution process, it can query the root domain name simulation node through the preset Internet Protocol address of the root domain name simulation node (eg, 192.168.1.10) to obtain the information of the top-level domain name server.

[0201] Furthermore, after receiving the query, the root domain name simulation node identifies that the top-level domain of the target subdomain is ".com" and returns the first address of the top-level domain simulation node responsible for ".com", for example, the first address is 192.168.1.20.

[0202] Furthermore, the recursive emulation node can use the first address of the top-level domain emulation node, 192.168.1.20, to send a query asking for authoritative information about example.com. The top-level domain emulation node 192.168.1.20 returns the address of the authoritative name emulation node for example.com to the recursive emulation node. Assume that the IP address of the authoritative name emulation node is 192.168.1.30. The recursive emulation node then sends a final query using the address of the authoritative name emulation node, 192.168.1.30, requesting the specific resolution record for www.example.com.

[0203] It should be noted that because the target subdomain has been hijacked and tampered with, the authoritative name simulation node queries the tampered subdomain resolution record and ultimately returns the tampered Internet Protocol address to the recursive simulation node, rather than the original correct Internet Protocol address. After receiving the tampered Internet Protocol address, the Domain Name System (DNS) will respond accordingly. At this point, the DNS response can be observed, and the DNS will return the simulation results of the abnormal domain behavior corresponding to the target subdomain.

[0204] Through the above methods, without affecting the real Internet environment, we can predict and analyze the risks that the target subdomain may encounter in the actual Internet environment in a safe and controllable target simulation environment. This helps to identify potential security vulnerabilities, develop and verify defense strategies, and improve the robustness and security of the domain name system, thereby better protecting domain names from hijacking and other network attacks in the real world.

[0205] In some embodiments, to more effectively address potential security threats, the system can compare simulation results with analysis results in a real environment to identify whether it has achieved active and effective defense against the corresponding risks. The attack and defense policy parameters of the domain name system can be adjusted accordingly to better address different risks. For example, after "inputting the target subdomain into the target simulation environment for simulation to obtain the simulation results of abnormal domain behavior" in step 106, the following steps may also be included:

[0206] (A.1) Inputting the target subdomain into the Internet environment to obtain a first Internet Protocol address corresponding to the target subdomain;

[0207] (A.2) comparing the domain name abnormal behavior simulation result with the first Internet Protocol address to obtain a comparison result;

[0208] (A.3) When the comparison result indicates that the first Internet Protocol address and the domain name abnormal behavior simulation result are inconsistent, the attack and defense strategy parameters of the domain name system are adjusted.

[0209] The first Internet Protocol address may be an Internet Protocol address corresponding to the target subdomain in an actual Internet environment (where there is no risk), and the first Internet Protocol address is a true resolution result of the target subdomain.

[0210] The comparison result may be a conclusion obtained by comparing the simulation result of abnormal behavior of the domain name obtained in the target simulation environment with the first Internet Protocol address obtained in the actual Internet environment.

[0211] Attack and defense policy parameters can be a series of settings and rules used to define and adjust network security protection measures. These parameters can include, but are not limited to, firewall rules, access control lists, and intrusion detection system / intrusion prevention system configurations. By adjusting these parameters, the domain name system's protection capabilities can be enhanced in a targeted manner.

[0212] For example, if in an Internet environment without any risks, the target subdomain name (such as www.example.com) is entered into the DNS resolution system to obtain its corresponding first Internet Protocol address (assuming it is 93.184.216.34). In the target simulation environment, after simulating abnormal behaviors such as domain name hijacking and tampering, the domain name abnormal behavior simulation result corresponding to the target subdomain name contains an Internet Protocol address of 192.168.1.100. Then, the domain name abnormal behavior simulation result and the first Internet Protocol address are compared. The comparison result indicates that the Internet Protocol addresses in the simulation environment and the real environment do not match, which indicates that the abnormal behavior simulated in the target simulation environment has successfully hijacked the domain name.

[0213] Furthermore, the attack and defense measurement parameters of the domain name system can be adjusted based on the above comparison results, such as updating firewall rules to block access to malicious Internet Protocol addresses discovered in the simulation, or adjusting the configuration of the intrusion detection system / intrusion prevention system to identify and defend against similar hijacking behaviors. The specific adjustments can be made based on actual conditions.

[0214] Through the above methods, potential security risks can be discovered in advance and network security protection strategies can be optimized to ensure that the domain name system can promptly identify and take effective protection measures when facing real domain name hijacking attacks, thereby improving the security and stability of the domain name system.

[0215] In some embodiments, since the resolution of two top-level domains in the same target simulation environment relies on the same authoritative name server (i.e., the domain name resolution records are stored by sharing the authoritative name server), modifying the resolution of one domain may affect the other domain. Therefore, in order to ensure that the simulation environment can correctly reproduce the association between the two, when simulating one domain name, it is necessary to simultaneously process the nodes of the other domain name to improve the consistency and accuracy of the domain name simulation. For example, the domain name abnormal behavior simulation method may also include:

[0216] (B.1) when there exists a first authoritative name simulation node associated with any of the first domain names when performing domain name resolution in the Internet environment, and the first authoritative name server node associated with the target domain name is the same, modifying the Internet Protocol address corresponding to the first domain name to a fourth Internet Protocol address in the target simulation environment;

[0217] (B.2) Performing a domain name abnormal behavior simulation on the first domain name to obtain a first domain name abnormal behavior simulation result corresponding to the first domain name.

[0218] The first domain name can be any domain name that shares the same authoritative name server node as the target domain name when performing domain name resolution in an Internet environment. For example, if example.com is the target domain name and example.net also uses the same authoritative name server node, then example.net can be considered the first domain name.

[0219] The first authoritative name simulation node may be a server node instance that provides authoritative name resolution services for the first domain name and the target domain name.

[0220] Among them, the fourth Internet Protocol address can be a new Internet Protocol address used to replace the real Internet Protocol address corresponding to the original first domain name, and is used to simulate abnormal behaviors or risk situations that the first domain name may face in the target simulation environment, such as hijacking, tampering, etc.

[0221] Among them, the abnormal behavior simulation result of the first domain name can be the result data obtained after abnormal behavior simulation of the first domain name, which includes but is not limited to the domain name system response status, resolution record changes, traffic path, response time, etc.

[0222] For example, assuming the target domain name is example.com, if the risk of the target domain name under a certain attack needs to be simulated in a target simulation environment to understand the target simulation environment's ability to cope with the risk, if the top-level domain ".com" in the target domain name relies on the authoritative name service node with the Internet Protocol address 192.0.2.1 in the Internet environment, and ".net" also relies on the authoritative name service node at 192.0.2.1, then this indicates that the authoritative name service node stores specific resolution records for the domain names example.com and example.net.

[0223] It is understandable that when, during the simulation process, it is necessary to modify the root zone record of the top-level domain ".com" of the target domain name so that ".com" points to the top-level domain simulation node address in the simulation environment (for example, 192.168.1.10), the resolution of ".net" in the simulation environment will also be affected. Therefore, in order to accurately simulate this collateral impact, the entries in ".com" and ".net" in the root zone file need to be modified at the same time in the simulation so that ".com" and ".net" point to the top-level domain simulation node address in the simulation environment.

[0224] Furthermore, for the ".com" top-level domain, a domain name disappearance and tampering (or other risks) can be simulated. Since ".net" and ".com" share the same authoritative name simulation node, it is also necessary to simulate the same target simulation environment for ".net" to evaluate the impact of risk simulation of a single top-level domain on the entire domain name resolution system when sharing an authoritative server. The specific simulation process can be referred to above and will not be repeated here.

[0225] Through the above methods, the security and stability of the domain name system can be comprehensively evaluated and tested, which helps to fully identify potential security vulnerabilities and maintain the consistency and accuracy of the simulation.

[0226] Please refer to Figure 1 and Figure 7 In some embodiments, combined Figure 1 and Figure 7 , introduce the overall process of this application.

[0227] For example, a user may send a domain name abnormal behavior simulation request through an application on a terminal. After receiving the domain name abnormal behavior simulation request, the simulation console may assign the task to a corresponding simulation module according to the request content.

[0228] Furthermore, the simulation console can send BGP instructions to the network simulation module to simulate the behavior of the Border Gateway Protocol. The network simulation module executes the BGP instructions, deploys multiple routing simulation nodes, and reports the execution status to the simulation status perception module. Simultaneously, the simulation console also sends system instructions to the system simulation module to simulate the real service nodes of the entire domain name system. The system simulation module executes the system instructions, deploys multiple real service nodes associated with the target domain name when performing domain name resolution in the Internet environment, obtains the corresponding root domain name simulation node, recursive simulation node, top-level domain simulation node, and authoritative name simulation node, and reports the execution status to the simulation console.

[0229] Furthermore, the node status data of each simulation node can be collected and injected into the corresponding simulation node to generate an initial simulation environment. Afterwards, the target simulation environment can be obtained by adjusting the object data corresponding to the target simulation environment. Furthermore, the target subdomain name can be input into the target simulation environment. During the simulation process, the simulation data of each simulation node and the simulation results of the abnormal behavior of the domain name of the target simulation environment can be collected by the simulation status perception module. The simulation status perception module can pass the collected simulation data to the simulation visualization module. The simulation visualization module generates visualization results based on these simulation data so that the user can intuitively understand the current status of the simulation environment. The simulation console can feed back the simulation results of the abnormal behavior of the domain name to the user side, so that the user can understand the execution status of the simulation operation requested by the user.

[0230] The embodiment of the present application responds to a domain name abnormal behavior simulation request and determines a target domain name that needs to be simulated for resolution from the domain name abnormal behavior simulation request; determines multiple real service nodes associated with the target domain name when performing domain name resolution in an Internet environment, and the multiple real service nodes communicate with each other through their respective routing nodes; through a container cluster manager, deploys simulation nodes corresponding to each real service node and each routing node respectively, so as to build a simulation node topology structure based on the multiple simulation nodes; obtains node status data of each real service node and each routing node in the Internet environment, and injects each set of node status data into the simulation node corresponding to the simulation node topology structure to generate a corresponding initial simulation environment; wherein the target domain name corresponds to different Internet Protocol addresses in the Internet environment and the initial simulation environment respectively; determines the target environment type to be simulated in the initial simulation environment according to the domain name abnormal behavior simulation request, and adjusts the corresponding object data in the initial simulation environment to convert the initial simulation environment into a target simulation environment corresponding to the target environment type; obtains any target subdomain contained in the target domain name, and inputs the target subdomain into the target simulation environment for simulation to obtain a domain name abnormal behavior simulation result. In this way, by constructing an initial simulation environment that is highly similar to the Internet environment in advance, it is possible to adjust the object data corresponding to different target environment types in the initial simulation environment under controlled conditions to simulate various risk behaviors that the domain name system may encounter, and test the response of the domain name system when facing various potential risks, thereby greatly shortening the time cycle from problem discovery to problem resolution, so as to timely discover weak links in the system and take measures to repair them before actual attacks occur, effectively improving the security and stability of the system, and ensuring that even in the face of complex network security threats, it can maintain good response capabilities. In summary, this application will not affect the actual Internet environment during the simulation process, and can timely discover and solve potential problems in the domain name system when responding to risks while maintaining system stability.

[0231] See also Figure 8 The embodiment of the present application further provides a domain name abnormal behavior simulation device, which can implement the above-mentioned domain name abnormal behavior simulation method. The domain name abnormal behavior simulation device includes:

[0232] A response module 81 is configured to respond to the domain name abnormal behavior simulation request and determine a target domain name that needs to be resolved and simulated from the domain name abnormal behavior simulation request;

[0233] A determination module 82 is configured to determine multiple real service nodes associated with a target domain name when performing domain name resolution in an Internet environment, wherein the multiple real service nodes communicate with each other through their respective routing nodes;

[0234] A deployment module 83 is configured to deploy, through a container cluster manager, a simulation node corresponding to each real service node and each routing node, respectively, to construct a simulation node topology structure based on the plurality of simulation nodes;

[0235] A generation module 84 is configured to obtain node status data of each real service node and each routing node in the Internet environment, and inject each set of node status data into a simulation node corresponding to the simulation node topology structure to generate a corresponding initial simulation environment; wherein the target domain name corresponds to different Internet Protocol addresses in the Internet environment and the initial simulation environment respectively;

[0236] The conversion module 85 is configured to determine the target environment type to be simulated in the initial simulation environment according to the domain name abnormal behavior simulation request, and adjust the corresponding object data in the initial simulation environment to convert the initial simulation environment into a target simulation environment corresponding to the target environment type;

[0237] The simulation module 86 is used to obtain any target subdomain contained in the target domain name, and input the target subdomain into the target simulation environment for simulation to obtain a simulation result of abnormal behavior of the domain name.

[0238] The specific implementation of the domain name abnormal behavior simulation device is basically the same as the specific embodiment of the domain name abnormal behavior simulation method described above, and will not be repeated here. Under the premise of meeting the requirements of the embodiment of this application, the domain name abnormal behavior simulation device can also be equipped with other functional modules to implement the domain name abnormal behavior simulation method in the above embodiment.

[0239] The present application also provides a computer device comprising a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the aforementioned domain name abnormal behavior simulation method. The computer device can be any intelligent terminal, including a tablet computer and an in-vehicle computer.

[0240] See also Figure 9 , Figure 9 The hardware structure of a computer device according to another embodiment is shown. The computer device includes:

[0241] The processor 91 may be implemented as a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application.

[0242] The memory 92 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 92 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program codes are stored in the memory 92 and are called by the processor 91 to execute the domain name abnormal behavior simulation method of the embodiments of this application.

[0243] Input / output interface 93, used for information input and output;

[0244] Communication interface 94, used to implement communication interaction between this device and other devices, which can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WiFi, Bluetooth, etc.);

[0245] bus 95 , which transmits information between the various components of the device (e.g., processor 91 , memory 92 , input / output interface 93 , and communication interface 94 );

[0246] The processor 91 , the memory 92 , the input / output interface 93 and the communication interface 94 are connected to each other in communication within the device via a bus 95 .

[0247] An embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the above-mentioned domain name abnormal behavior simulation method.

[0248] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0249] The embodiments described in the embodiments of this application are intended to more clearly illustrate the technical solutions of the embodiments of this application and do not constitute a limitation on the technical solutions provided by the embodiments of this application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0250] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0251] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, i.e., they may be located in one place or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of this embodiment.

[0252] Those skilled in the art will appreciate that all or some of the steps in the methods, systems, and functional modules / units in the devices disclosed above may be implemented as software, firmware, hardware, or appropriate combinations thereof.

[0253] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0254] It should be understood that in this application, "at least one (item)" and "several" refer to one or more, and "plurality" refers to two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0255] In the several embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative. For example, the division of the above units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0256] The units described above as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0257] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0258] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes multiple instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: various media that can store programs, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0259] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but are not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and essence of the present invention should be within the scope of the present invention.

Claims

1. A method for simulating abnormal behavior of a domain name, characterized in that: The method comprises: Responding to a domain name abnormal behavior simulation request, and determining a target domain name that needs to be parsed and simulated from the domain name abnormal behavior simulation request; Determining multiple real service nodes associated with the target domain name when performing domain name resolution in an Internet environment, wherein the multiple real service nodes communicate with each other through their respective routing nodes; Through the container cluster manager, deploy the simulation nodes corresponding to each real service node and each routing node respectively, so as to build a simulation node topology structure based on multiple simulation nodes; Obtaining node status data of each real service node and each routing node in the Internet environment, and injecting each set of node status data into the simulation node corresponding to the simulation node topology structure to generate a corresponding initial simulation environment; wherein the target domain name corresponds to different Internet Protocol addresses in the Internet environment and the initial simulation environment respectively; Determining a target environment type to be simulated in the initial simulation environment according to the domain name abnormal behavior simulation request, and adjusting corresponding object data in the initial simulation environment to convert the initial simulation environment into a target simulation environment corresponding to the target environment type; Obtain any target subdomain contained in the target domain name, and input the target subdomain into the target simulation environment for simulation to obtain a domain name abnormal behavior simulation result.

2. The domain name abnormal behavior simulation method according to claim 1, characterized in that: The types of the simulation nodes include at least a root domain name simulation node, a recursive simulation node, a top-level domain simulation node, and an authoritative name simulation node. Inputting the target subdomain name into the target simulation environment for simulation to obtain a simulation result of abnormal domain name behavior includes: Inputting the target subdomain into the target simulation environment, and determining a corresponding recursive simulation node from the target simulation environment according to the target subdomain; Determine the root domain name simulation node corresponding to the target subdomain name through the recursive simulation node; Acquire the top-level domain of the target subdomain, and transmit the first address of the top-level domain simulation node to the recursive simulation node based on the top-level domain through the root domain simulation node; Accessing the top-level domain simulation node based on the first address through the recursive simulation node to obtain the authoritative name simulation node address of the target subdomain name; Through the recursive simulation node, the authoritative name simulation node is accessed based on the authoritative name simulation node address, so that the authoritative name simulation node returns the domain name abnormal behavior simulation result corresponding to the target subdomain name by querying the subdomain name resolution record of the target subdomain name.

3. The domain name abnormal behavior simulation method according to claim 1, characterized in that: After inputting the target subdomain into the target simulation environment for simulation and obtaining a simulation result of abnormal domain behavior, the method further includes: Inputting the target subdomain into the Internet environment to obtain a first Internet Protocol address corresponding to the target subdomain; Comparing the domain name abnormal behavior simulation result with the first Internet Protocol address to obtain a comparison result; When the comparison result indicates that the first Internet Protocol address is inconsistent with the domain name abnormal behavior simulation result, the attack and defense strategy parameters of the domain name system are adjusted.

4. The domain name abnormal behavior simulation method according to claim 1, characterized in that: The target environment type is service suspension, the object data is an access control list, and adjusting the corresponding object data in the initial simulation environment to convert the initial simulation environment into a target simulation environment corresponding to the target environment type includes: In the initial simulation environment, determining a domain name resolution configuration module of the target domain name in a corresponding authoritative name simulation node; Setting an access control list in the domain name resolution configuration module, and adding the Internet Protocol address segment where the recursive simulation node corresponding to the target domain name is located to the access control list to restrict the recursive simulation node from accessing the domain name resolution record stored in the authoritative name simulation node; A target simulation environment corresponding to the target environment type is updated.

5. The domain name abnormal behavior simulation method according to claim 1, characterized in that: The target environment type is disconnected and service suspended, and the object data includes a restricted access list; and adjusting the corresponding object data in the initial simulation environment to convert the initial simulation environment into a target simulation environment corresponding to the target environment type further includes: In the initial simulation environment, determining a target routing node of the target domain name in the authoritative name simulation node; Establishing a restricted access list in the routing configuration of the target routing node, and adding the Internet Protocol address segment where the recursive simulation node corresponding to the target domain name is located to the restricted access list to limit the traffic data sent by the recursive simulation node to the authoritative name simulation node; A target simulation environment corresponding to the target environment type is updated.

6. The domain name abnormal behavior simulation method according to claim 1, characterized in that: The target environment type is domain name disappearance and tampering, the object data includes a target zone file, and the adjusting of the corresponding object data in the initial simulation environment to convert the initial simulation environment into a target simulation environment corresponding to the target environment type further includes: In the initial simulation environment, determining an authoritative name simulation node corresponding to the target domain name; In the authoritative name simulation node, a target zone file is determined; wherein the target zone file is at least used to store a mapping relationship between the target domain name and the corresponding second Internet Protocol address; Deleting the resource record corresponding to the target domain name in the target zone file; A target simulation environment corresponding to the target environment type is updated.

7. The domain name abnormal behavior simulation method according to claim 1, characterized in that: The target environment type is domain name hijacking and tampering, the object data includes a target zone file, and the adjusting of the corresponding object data in the initial simulation environment to convert the initial simulation environment into a target simulation environment corresponding to the target environment type further includes: In the initial simulation environment, determining an authoritative name simulation node corresponding to the target domain name; In the authoritative name simulation node, a target zone file is determined; wherein the target zone file is at least used to store a mapping relationship between the target domain name and the corresponding second Internet Protocol address; In the target area file, the second Internet Protocol address is modified to a third Internet Protocol address; wherein the third Internet Protocol address points to an abnormal web page; A target simulation environment corresponding to the target environment type is updated.

8. The domain name abnormal behavior simulation method according to claim 1, characterized in that: The container cluster manager is used to deploy simulation nodes corresponding to each real service node and each routing node, respectively, to construct a simulation node topology structure based on multiple simulation nodes, including: Deploy, through a container cluster manager, a simulation node corresponding to each real service node and each routing node in at least one virtual server node; Based on the border gateway protocol, network data is deployed for each simulation node corresponding to each routing node, and a simulation node topology structure is constructed according to the deployed multiple simulation nodes.

9. The domain name abnormal behavior simulation method according to claim 1, characterized in that: The method further comprises: When there exists a first authoritative name simulation node associated with any first domain name when performing domain name resolution in the Internet environment, and the first authoritative name server node associated with the target domain name is the same, modifying the Internet Protocol address corresponding to the first domain name in the target simulation environment to a fourth Internet Protocol address; Perform domain name abnormal behavior simulation on the first domain name to obtain a first domain name abnormal behavior simulation result corresponding to the first domain name.

10. A domain name abnormal behavior simulation device, characterized in that: The device comprises: A response module, configured to respond to a domain name abnormal behavior simulation request and determine a target domain name that needs to be parsed and simulated from the domain name abnormal behavior simulation request; a determination module, configured to determine a plurality of real service nodes associated with the target domain name when performing domain name resolution in an Internet environment, wherein the plurality of real service nodes communicate with each other through respective routing nodes; A deployment module is used to deploy each real service node and each simulation node corresponding to the routing node through the container cluster manager, so as to build a simulation node topology structure according to the multiple simulation nodes; a generation module configured to obtain node status data of each real service node and each routing node in the Internet environment, and inject each set of node status data into the simulation node corresponding to the simulation node topology structure to generate a corresponding initial simulation environment; wherein the target domain name corresponds to different Internet Protocol addresses in the Internet environment and the initial simulation environment respectively; a conversion module, configured to determine a target environment type to be simulated in the initial simulation environment according to the domain name abnormal behavior simulation request, and adjust corresponding object data in the initial simulation environment to convert the initial simulation environment into a target simulation environment corresponding to the target environment type; The simulation module is used to obtain any target subdomain contained in the target domain name, and input the target subdomain into the target simulation environment for simulation to obtain a simulation result of abnormal domain behavior.

11. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the domain name abnormal behavior simulation method according to any one of claims 1 to 9 when executing the computer program.

12. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the domain name abnormal behavior simulation method according to any one of claims 1 to 9 is implemented.

Images