Master-slave domain name identification method and device based on dynamic sliding window

Abstract

The invention provides a master-slave domain name identification method and device based on a dynamic sliding window, and the method comprises the steps: obtaining a DNS request record on a managed network boundary, dividing the DNS request record into a request record set of a plurality of users based on a source IP address, and determining a request sequence corresponding to each service request of each user based on the request record set of each user; obtaining the total number of DNS requests in the preset area and the time period length of the DNS request statistics time period, and calculating the network traffic density based on the total number of DNS requests, the time period length and the size of the preset area; obtaining the total number of time periods for DNS request statistics, and calculating a dynamic time threshold value based on the network traffic density corresponding to each time period and the total number of the time periods; and obtaining at least part of DNS requests in each request sequence by taking the dynamic time threshold as a dynamic sliding window to obtain each request sub-sequence, and determining a main domain name and a slave domain name of each service based on each request sub-sequence. According to the master-slave domain name identification method, the identification accuracy of the master-slave domain names is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of domain name identification, and in particular to a method and device for identifying master and slave domain names based on a dynamic sliding window. Background Art

[0002] The real-time domain name traffic collected by the encrypted domain name monitoring system is caused by tens of thousands of users in the network accessing multiple network services at the same time. However, there is no one-to-one correspondence between domain names and encrypted services. Only domain names that represent services can be used as research objects for subsequent service feature discovery, so domain names need to be classified. The primary and secondary domain names refer to the domain name that is first requested by the user in a service access as the primary domain name, representing the service itself; the domain name requested along with the request of the primary domain name is defined as the secondary domain name, representing the service resources that cooperate with the primary domain name to complete this service. Identifying the primary and secondary domain names helps to screen out the primary domain names with service significance as the objects of subsequent feature discovery, thereby improving the accuracy and efficiency of service monitoring.

[0003] At present, there are existing methods that observe and analyze domain name traffic based on a sliding window mechanism; this existing method determines the primary and secondary domain names based on the temporal correlation of domain name requests when accessing services, the number of domain name appearances, and the domain name request time; although this existing method can realize the identification of primary and secondary domain names, the window value in the sliding window mechanism is fixed, which will limit the accuracy of identifying primary and secondary domain names in a dynamically changing network environment. Therefore, how to improve the accuracy of identifying primary and secondary domain names in a dynamically changing network environment is a technical problem that needs to be solved urgently. Summary of the invention

[0004] In view of this, an embodiment of the present invention provides a method and device for identifying master and slave domain names based on a dynamic sliding window to eliminate or improve one or more defects in the prior art.

[0005] One aspect of the present invention provides a method for identifying a master and a slave domain name based on a dynamic sliding window, the method comprising:

[0006] Obtaining DNS request records on the managed network boundary, dividing the DNS request records into request record sets of multiple users based on source IP addresses, and determining a request sequence corresponding to each service request of each user based on the request record sets of each user;

[0007] Obtaining the total number of DNS requests in a preset area and the length of a time period of a DNS request statistics period, and calculating the network traffic density based on the total number of DNS requests, the length of the time period, and the size of the preset area;

[0008] Obtain the total number of time periods for DNS request statistics, and calculate the dynamic time threshold based on the network traffic density corresponding to each time period and the total number of time periods;

[0009] At least part of the DNS requests in each of the request sequences are acquired using the dynamic time threshold as a dynamic sliding window to obtain each request subsequence, and the primary domain name and the secondary domain name of each service are determined based on each of the request subsequences.

[0010] In some embodiments of the present invention, the calculation formula of the dynamic time threshold is:

[0011] Where n represents the total number of time periods, ρ i represents the network traffic density in the i-th time period, It represents the average network traffic density in n time periods, and k represents the window sensitivity adjustment coefficient.

[0012] In some embodiments of the present invention, determining the primary domain name and the secondary domain name of each service based on each of the request subsequences includes:

[0013] Obtaining a similar domain name set corresponding to each of the request subsequences;

[0014] The primary domain name and the secondary domain name of the service in each of the similar domain name sets are identified.

[0015] In some embodiments of the present invention, obtaining a similar domain name set corresponding to each of the request subsequences includes:

[0016] Based on the cosine similarity calculation method, a similar domain name set corresponding to each request subsequence is calculated.

[0017] In some embodiments of the present invention, identifying the primary domain name and the secondary domain name of the service in each of the similar domain name sets includes:

[0018] The domain name corresponding to the DNS request with the earliest request time in each of the similar domain name sets is used as the primary domain name of each service;

[0019] Generate each master and slave domain name set based on the DNS requests in which the number of domain name accesses in each similar domain name set is greater than a preset threshold;

[0020] The slave domain name of each service is determined based on each of the master and slave domain name sets and each of the master domain names.

[0021] In some embodiments of the present invention, determining a request sequence corresponding to each service request of each user based on a request record set of each user includes:

[0022] Each request record set is divided into a plurality of request record subsets based on the secondary domain name of each DNS request in each request record set, and the plurality of DNS requests in each request record subset are sorted based on access time to obtain a request sequence corresponding to each service request of each user.

[0023] In some embodiments of the present invention, the network traffic density is calculated as follows:

[0024]

[0025] Among them, ρ represents the network traffic density, D represents the total number of DNS requests, T represents the length of the time period, and A represents the size of the preset area.

[0026] In some embodiments of the present invention, generating each master-slave domain name set based on the DNS request of the domain name access times in each similar domain name set being greater than a preset threshold includes:

[0027] Counting the number of visits to each domain name in each of the similar domain name sets;

[0028] sorting the domain names based on the number of visits;

[0029] When the difference between the number of visits to the first domain name and the number of visits to the second domain name is not less than half of the number of visits to the first domain name, a master-slave domain name set is generated based on the first domain name and other domain names with a greater number of visits than the first domain name.

[0030] According to another aspect of the present invention, a master-slave domain name identification system based on a dynamic sliding window is also disclosed, including a processor, a memory, and a computer program stored in the memory, the processor is used to execute the computer program, and when the computer program is executed, the system implements the steps of the method described in any of the above embodiments.

[0031] According to another aspect of the present invention, there is provided a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the method described in any of the above embodiments are implemented.

[0032] The method for identifying primary and secondary domain names based on a dynamic sliding window disclosed in an embodiment of the present invention first calculates the network traffic density, then determines the dynamic time threshold based on the network traffic density, and then uses the calculated dynamic time threshold as a dynamic sliding window to obtain the corresponding DNS requests in each request sequence to obtain each request subsequence, and finally determines the primary domain name and secondary domain name of each service based on each request subsequence. When the method obtains the DNS requests within the window range based on the sliding window, the size of the sliding window will be adaptively adjusted based on the change of the network traffic density, so that the DNS requests related to the service can be captured more accurately, thereby improving the recognition accuracy of the primary and secondary domain names in a dynamically changing network environment.

[0033] Additional advantages, purposes, and features of the present invention will be described in part in the following description, and will become apparent to those skilled in the art after studying the following, or may be learned from the practice of the present invention. The purposes and other advantages of the present invention may be achieved and obtained by the structures specifically indicated in the specification and the accompanying drawings.

[0034] Those skilled in the art will appreciate that the objectives and advantages that can be achieved with the present invention are not limited to the above specific description, and the above and other objectives that can be achieved by the present invention will be more clearly understood from the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The drawings described herein are used to provide a further understanding of the present invention, constitute a part of this application, and do not constitute a limitation of the present invention. The components in the drawings are not drawn to scale, but are only for illustrating the principles of the present invention. In order to facilitate the illustration and description of some parts of the present invention, the corresponding parts in the drawings may be enlarged, that is, they may become larger relative to other components in the exemplary device actually manufactured according to the present invention. In the drawings:

[0036] Figure 1 The figure is a flow chart of a method for identifying master and slave domain names based on a dynamic sliding window according to an embodiment of the present invention.

[0037] Figure 2 The figure is a flow chart of a method for identifying master and slave domain names based on a dynamic sliding window according to another embodiment of the present invention. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments and the accompanying drawings. Here, the illustrative embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0039] It should also be noted that, in order to avoid obscuring the present invention due to unnecessary details, only structures and / or processing steps closely related to the solutions according to the present invention are shown in the accompanying drawings, while other details that are not closely related to the present invention are omitted.

[0040] It should be emphasized that the term “include / comprises” when used herein refers to the presence of features, elements, steps or components, but does not exclude the presence or addition of one or more other features, elements, steps or components.

[0041] In order to solve the problem of low master-slave domain name recognition accuracy in a dynamically changing network environment in the master-slave domain name extraction method based on a sliding window mechanism in the prior art, the present invention proposes a master-slave domain name recognition method and device based on a dynamic sliding window. The method adapts to different encrypted domain name network traffic and behavior patterns, dynamically adjusts the window size according to the changes in real-time network traffic, so as to more accurately capture the relevant domain name set, thereby improving the master-slave domain name recognition accuracy in a dynamically changing network environment. It can be understood that the master-slave domain name recognition method based on a dynamic sliding window disclosed in the present invention can be used for the recognition of traditional domain names, and can also be used for the recognition of encrypted domain names.

[0042] It should also be noted that, unless otherwise specified, the term “connection” herein may refer not only to a direct connection but also to an indirect connection involving an intermediate.

[0043] Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. In the accompanying drawings, the same reference numerals represent the same or similar components, or the same or similar steps.

[0044] Figure 1 FIG. 1 is a flow chart of a method for identifying a master and slave domain name based on a dynamic sliding window according to an embodiment of the present invention. Figure 1 As shown, the master-slave domain name identification method at least includes steps S10 to S40.

[0045] Step S10: Obtain DNS request records on the managed network boundary, divide the DNS request records into request record sets of multiple users based on source IP addresses, and determine request sequences corresponding to each service request of each user based on the request record sets of each user.

[0046] In this step, the obtained DNS request records on the managed network boundary are used for domain name traffic observation and resolution, and all DNS requests are divided based on the source IP to distinguish service access of different users; that is, this step divides all DNS requests on the managed network boundary into multiple request record sets, and the number of request record sets is equal to the number of users making service requests, so that the DNS request records are divided into multiple users' request record sets based on the source IP address.

[0047] After determining the request record set of each user, the request sequence corresponding to each service request of each user is further determined based on the request record set of each user. Specifically, the DNS requests in the request record set are DNS requests related to different services. Therefore, when determining the request sequence corresponding to each service request based on the request record set, the DNS requests in the request record set are first divided based on the secondary domain name of the request domain name, so as to distinguish different service requests of the same user.

[0048] Exemplarily, determining the request sequence corresponding to each service request of each user based on the request record set of each user may specifically include: dividing each request record set into multiple request record subsets based on the secondary domain name of each DNS request in each request record set, sorting the multiple DNS requests in each request record subset based on the access time, and obtaining the request sequence corresponding to each service request of each user. In this embodiment, each request record subset represents a service request of the user, so each user has multiple request record subsets. In addition, all DNS requests in each request record subset are sorted according to the request timestamp, so that each request sequence corresponding to each request record subset can be obtained; it can be understood that the sorting method of the DNS requests in the request sequence is not specifically limited, and can be sorted in descending order based on the request time or in ascending order.

[0049] Step S20: Obtain the total number of DNS requests in the preset area and the time period length of the DNS request statistics time period, and calculate the network traffic density based on the total number of DNS requests, the time period length and the preset area size.

[0050] In this step, the network traffic density is calculated based on the total number of DNS requests, the time period, and the preset area size. Traffic density refers to the number of clicks from different IP addresses per unit time. Therefore, in this step, the network traffic density is calculated based on the total number of DNS requests from all users in the preset area.

[0051] In one embodiment, the calculation formula of network traffic density is:

[0052]

[0053] Wherein, ρ represents the network traffic density, D represents the total number of DNS requests, T represents the time period, and A represents the preset area size; in this embodiment, given that D is the total amount of data passing through the network within the time interval T under consideration, the preset area A is the network area size corresponding to the traffic of the currently detected encrypted domain name (or non-encrypted domain name). It can be understood that the calculation method of the network traffic density listed in this embodiment is only an example, and the network traffic density can also be calculated based on other methods.

[0054] Step S30: Obtain the total number of time periods for DNS request statistics, and calculate the dynamic time threshold based on the network traffic density corresponding to each time period and the total number of time periods.

[0055] In this step, the dynamic time threshold is adaptively calculated based on the density of network traffic, so that the size of the sliding window is adaptively adjusted based on the calculated dynamic time threshold. Exemplarily, the dynamic time threshold is composed of a reference time length and a dynamic adjustment factor.

[0056] In one embodiment, the calculation formula of the dynamic time threshold may be: Where n represents the total number of time periods, ρ i represents the network traffic density in the i-th time period, represents the average network traffic density in n time periods, and k represents the window sensitivity adjustment coefficient. In this embodiment, is the base value, Represents the average fluctuation degree of the network density in a local time period relative to the average network density in all time periods in the current preset area.

[0057] In the above embodiment, since the dynamic time threshold is calculated based on the network traffic density, the dynamic time threshold will also change as the network traffic density changes. Therefore, when obtaining the DNS request based on the sliding window mechanism, the size of the sliding window is selected based on the calculated dynamic time threshold, thereby realizing dynamic adjustment of the sliding window.

[0058] Step S40: using the dynamic time threshold as a dynamic sliding window to obtain at least part of the DNS requests in each of the request sequences to obtain each request subsequence, and determining the primary domain name and the secondary domain name of each service based on each of the request subsequences.

[0059] In this step, the dynamic time threshold calculated in step S30 is used as the size of the sliding window, and each request subsequence is obtained from each request sequence, and the primary domain name and the secondary domain name of each service are further determined based on each request subsequence. In this step, the DNS request in the request subsequence is part or all of the DNS request in the request sequence, that is, the request subsequence and the multiple DNS request information in the request sequence are arranged in ascending or descending order based on the timestamp. Exemplarily, when a request subsequence is obtained by obtaining part of the DNS requests from the request sequence using the dynamic time threshold as the dynamic sliding window, the DNS requests within the sliding window range in the request sequence can be directly combined into a request subsequence.

[0060] In addition, determining the primary domain name and the secondary domain name of each service based on each of the request subsequences may specifically include the following steps: obtaining a similar domain name set corresponding to each of the request subsequences; and identifying the primary domain name and the secondary domain name of the service in each of the similar domain name sets.

[0061] Furthermore, the DNS requests in each similar domain name set are requests with high domain name similarity. When generating similar domain name sets based on each request subsequence, the similar domain name sets corresponding to each request subsequence can be calculated based on the cosine similarity calculation method; the cosine similarity calculation method measures the similarity by measuring the cosine value of the angle between two vectors. In this embodiment, the cosine similarity calculation method can determine whether the two DNS requests are classified into the same similar domain name set by measuring the similarity between the two DNS requests. It should be understood that this embodiment is an implementation method for obtaining a similar domain name set from a request subsequence based on the cosine similarity calculation method, and in other embodiments, the similarity between DNS requests can also be calculated based on other methods.

[0062] In another embodiment, identifying the primary domain name and the secondary domain name of the service in each of the similar domain name sets includes: taking the domain name corresponding to the DNS request with the earliest request time in each of the similar domain name sets as the primary domain name of each service; generating each primary and secondary domain name set based on the DNS request with the domain name access times greater than a preset threshold in each of the similar domain name sets; determining the secondary domain name of each service based on each of the primary and secondary domain name sets and each of the primary domain names. In this embodiment, the primary domain name and the secondary domain name of the service are further identified from the similar domain name set, the primary domain name is the domain name with the earliest request time in the similar domain name set, and the other domain names in the primary and secondary domain name set except the primary domain name are all secondary domain names.

[0063] Specifically, each master-slave domain name set is generated based on the DNS request whose domain name access times in each similar domain name set is greater than a preset threshold, including: counting the access times of each domain name in each similar domain name set; sorting the domain names based on each of the access times; when the difference between the access times of the first domain name and the access times of the second domain name is not less than half of the access times of the first domain name, generating a master-slave domain name set based on the first domain name and other domain names whose access times are greater than the first domain name. This embodiment discloses the step of generating a master-slave domain name set based on a similar domain name set, after sorting all the domain names in the similar domain name set based on the access times of the domain names, if the total access times of the latter domain name (which can be understood as the second domain name) are attenuated by more than half of the number of occurrences of the former domain name (which can be understood as the first domain name), then a master-slave domain name set is generated based on all the domain names before the latter domain name; it can be understood that the total access times of each domain name before the latter domain name are greater than the total access times of the latter domain name, and the total access times of each domain name before the latter domain name are more than twice the total access times of the latter domain name.

[0064] In a specific embodiment, in order to extract the primary domain name and secondary domain name of each service, firstly, the similar domain name set corresponding to each request subsequence can be calculated based on the cosine similarity calculation method, and then the number of occurrences of each domain name in all similar domain name sets is counted, arranged in descending order, and then compared in sequence. If the number of occurrences of the latter domain name is more than half of the number of occurrences of the previous domain name, the comparison is stopped, and the set formed by all domain names before the latter domain name is the primary and secondary domain name set corresponding to the service. In addition, the domain name with the earliest request timestamp in each similar domain name set is counted. If a domain name is the earliest requested in its set in most cases, then the domain name is considered to be the primary domain name corresponding to the service, and the other domain names in the primary and secondary domain name set are secondary domain names corresponding to the service. The domain name similarity calculation can be implemented using the existing cosine similarity calculation method, and can be implemented through existing open source scripts.

[0065] Through the above embodiments, it can be found that the master-slave domain name identification method based on the dynamic sliding window of the present application first calculates the network traffic density, then determines the dynamic time threshold based on the network traffic density, and then uses the calculated dynamic time threshold as the dynamic sliding window to obtain at least part of the DNS requests in each request sequence to obtain each request subsequence, and finally determines the master domain name and slave domain name of each service based on each request subsequence. When the method obtains the DNS requests within the window range based on the sliding window, the size of the sliding window will be adaptively adjusted based on the change of the network traffic density, so that the DNS requests related to the service can be captured more accurately, thereby improving the recognition accuracy of the master and slave domain names in a dynamically changing network environment.

[0066] Figure 2FIG. 1 is a flow chart of a method for identifying master and slave domain names based on a dynamic sliding window according to another embodiment of the present invention. Figure 2 As shown, the master-slave domain name identification method first observes and analyzes the domain name traffic in step S11 to distinguish the service access of different users; then sorts the secondary domain name of each user according to the timestamp in step S12; further determines the dynamic sliding time window in step S13; finally, in step S14, the master-slave domain names are analyzed based on the defined dynamic sliding time window, and the master-slave domain name set corresponding to the service and the master domain name in the master-slave domain name set are determined from the similar domain name set, and the domain names whose total access times within the time window exceed the preset fixed times are included in the master-slave domain name set domain name analysis, and the domain names whose total access times do not reach the preset fixed times are retained and wait for the next comparison.

[0067] Specifically, in the step of observing and analyzing domain name traffic and distinguishing service access of different users, the DNS request records at the boundary of the managed network captured by the domain name monitoring system are first divided according to the source IP and decomposed into DNS request record sets of different users to distinguish service access of different users; then, the domain name face features are extracted from the request records, and the DNS request record set is further divided according to the second-level domain name of the requested domain name, and decomposed into multiple request record subsets corresponding to the users and the second-level domain names to distinguish different service access of the same user.

[0068] In the step of sorting each user's second-level domain name according to timestamp, specifically, each second-level domain name record set (request record subset) of each user is sorted within the set according to the request timestamp to obtain the DNS request sequence of each user's second-level domain name.

[0069] In the step of determining the dynamic sliding time window, specifically, the network traffic density is first calculated, and then the dynamic time threshold is calculated based on the calculated network traffic density.

[0070] In the master-slave domain name identification step, the request subsequence extracted based on the dynamic sliding window is internally divided based on the domain name similarity, that is, the domain names with more than the preset number of domain name requests in the time window are analyzed, and the domain names that have not reached the preset number are retained and wait for the next comparison. Specifically, the master-slave domain name set corresponding to the service and the master domain name in the master-slave domain name set are determined from the similar domain name set.

[0071] Correspondingly, the present invention also provides a master-slave domain name identification system based on a dynamic sliding window, comprising a processor, a memory and a computer program stored in the memory, wherein the processor is used to execute the computer program, and when the computer program is executed, the system implements the steps of the method described in any of the above embodiments.

[0072] The embodiment of the present invention also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of the aforementioned edge computing server deployment method are implemented. The computer-readable storage medium can be a tangible storage medium, such as a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable storage disk, a CD-ROM, or any other form of storage medium known in the technical field.

[0073] It should be understood by those skilled in the art that the exemplary components, systems and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software or a combination of the two. Whether it is performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present invention are programs or code segments used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link via a data signal carried in a carrier.

[0074] It should be clear that the present invention is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present invention.

[0075] In the present invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with features of other embodiments or replace features of other embodiments.

[0076] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the embodiments of the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for identifying master and slave domain names based on a dynamic sliding window, characterized in that: The master-slave domain name identification method comprises: Obtaining DNS request records on the managed network boundary, dividing the DNS request records into request record sets of multiple users based on source IP addresses, and determining a request sequence corresponding to each service request of each user based on the request record set of each user; Obtaining the total number of DNS requests in a preset area and the length of a time period of a DNS request statistics period, and calculating the network traffic density based on the total number of DNS requests, the length of the time period, and the size of the preset area; Obtain the total number of time periods for DNS request statistics, and calculate the dynamic time threshold based on the network traffic density corresponding to each time period and the total number of time periods; At least part of the DNS requests in each of the request sequences are acquired using the dynamic time threshold as a dynamic sliding window to obtain each request subsequence, and the primary domain name and the secondary domain name of each service are determined based on each of the request subsequences.

2. The method for identifying master and slave domain names based on a dynamic sliding window according to claim 1 is characterized in that: The calculation formula of dynamic time threshold is: Where n represents the total number of time periods, ρ i represents the network traffic density in the i-th time period, It represents the average network traffic density in n time periods, and k represents the window sensitivity adjustment coefficient.

3. The method for identifying master and slave domain names based on a dynamic sliding window according to claim 1 is characterized in that: Determining the primary domain name and the secondary domain name of each service based on each of the request subsequences includes: Obtaining a similar domain name set corresponding to each of the request subsequences; The primary domain name and the secondary domain name of the service in each of the similar domain name sets are identified.

4. The method for identifying master and slave domain names based on a dynamic sliding window according to claim 3 is characterized in that: Obtaining a similar domain name set corresponding to each of the request subsequences, including: Based on the cosine similarity calculation method, a similar domain name set corresponding to each request subsequence is calculated.

5. The method for identifying master and slave domain names based on a dynamic sliding window according to claim 3 is characterized in that: Identifying the primary domain name and the secondary domain name of the service in each of the similar domain name sets includes: The domain name corresponding to the DNS request with the earliest request time in each of the similar domain name sets is used as the primary domain name of each service; Generate each master and slave domain name set based on the DNS requests in which the number of domain name accesses in each similar domain name set is greater than a preset threshold; The slave domain name of each service is determined based on each of the master and slave domain name sets and each of the master domain names.

6. The method for identifying master and slave domain names based on a dynamic sliding window according to claim 1 is characterized in that: Determining a request sequence corresponding to each service request of each user based on the request record set of each user includes: Each request record set is divided into a plurality of request record subsets based on the secondary domain name of each DNS request in each request record set, and the plurality of DNS requests in each request record subset are sorted based on access time to obtain a request sequence corresponding to each service request of each user.

7. The method for identifying master and slave domain names based on a dynamic sliding window according to any one of claims 1 to 6, characterized in that: The calculation formula of the network traffic density is: Among them, ρ represents the network traffic density, D represents the total number of DNS requests, T represents the length of the time period, and A represents the size of the preset area.

8. The method for identifying master and slave domain names based on a dynamic sliding window according to claim 5, characterized in that: Generating each master and slave domain name set based on the DNS request whose domain name access times in each similar domain name set is greater than a preset threshold, including: Counting the number of visits to each domain name in each of the similar domain name sets; sorting the domain names based on the number of visits; When the difference between the number of visits to the first domain name and the number of visits to the second domain name is not less than half of the number of visits to the first domain name, a master-slave domain name set is generated based on the first domain name and other domain names with a greater number of visits than the first domain name.

9. A master-slave domain name identification system based on a dynamic sliding window, comprising a processor, a memory and a computer program stored in the memory, characterized in that: The processor is used to execute the computer program. When the computer program is executed, the system implements the steps of the method according to any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images