Master-slave domain name identification method and device based on dynamic sliding window

Abstract

The application provides a master-slave domain name identification method and device based on a dynamic sliding window, comprising: acquiring DNS request records on the boundary of a managed network, dividing the DNS request records into multiple user request record sets based on source IP addresses, determining the request sequences corresponding to each service request of each user based on the request record sets of each user; acquiring the total number of DNS requests in a preset area and the time period length of the time period of DNS request statistics, calculating the network traffic density based on the total number of DNS requests, the time period length and the preset area size; acquiring the total number of time periods of DNS request statistics, calculating a dynamic time threshold based on the network traffic density corresponding to each time period and the total number of time periods; obtaining at least part of the DNS requests in each request sequence to obtain each request sub-sequence by taking the dynamic time threshold as a dynamic sliding window, and determining the master domain name and the slave domain name of each service based on each request sub-sequence. The master-slave domain name identification method improves the identification accuracy of master-slave domain names.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of domain name recognition, and in particular to a master-slave domain name recognition method and device based on a dynamic sliding window. BACKGROUND

[0002] The real-time domain name traffic collected by the encrypted domain name monitoring system is caused by the simultaneous access of tens of thousands of users in the managed network to multiple network services. However, the domain name and the encrypted service are not in a one-to-one correspondence, and only the domain name with service representative significance can be used as the research object of subsequent service feature discovery, so it is necessary to classify the domain name. The master-slave domain name refers to defining the domain name requested first by the user in a service access as the master domain name, which represents the service itself, and defining the domain name requested along with the request of the master domain name as the slave domain name, which represents the service resource that cooperates with the master domain name to complete the service. Identifying the master-slave domain name helps to filter out the master domain name with service significance as the object of subsequent feature discovery, thereby improving the accuracy and efficiency of service monitoring.

[0003] At present, the existing method observes and analyzes the domain name traffic based on the sliding window mechanism. According to the correlation of the domain name request in time during service access, the existing method determines the master-slave domain name according to the number of domain name occurrences and the domain name request time. Although the existing method can realize the identification of the master-slave domain name, the window value in the sliding window mechanism is fixed, which will limit the identification accuracy of the master-slave domain name in a dynamically changing network environment. Therefore, how to improve the identification accuracy of the master-slave domain name in a dynamically changing network environment is a technical problem to be solved. SUMMARY

[0004] In view of this, the embodiments of the present application provide a master-slave domain name recognition method and device based on a dynamic sliding window to eliminate or improve one or more defects in the prior art.

[0005] One aspect of the present application provides a master-slave domain name recognition method based on a dynamic sliding window, which comprises:

[0006] Obtaining DNS request records on the boundary of the managed network, dividing the DNS request records into request record sets of multiple users based on source IP addresses, and determining the request sequence corresponding to each service request of each user based on the request record set of each user;

[0007] Obtaining the total number of DNS requests in a preset area and the time period length of the DNS request statistics, and calculating the network traffic density based on the total number of DNS requests, the time period length, and the preset area size;

[0008] obtaining a total number of time periods for DNS request statistics, calculating a dynamic time threshold based on network traffic density corresponding to each time period and the total number of time periods;

[0009] obtaining at least part of DNS requests in each request sequence based on the dynamic time threshold as a dynamic sliding window, determining the primary domain name and the slave domain name of each service based on each request sub-sequence.

[0010] In some embodiments of the application, the formula for calculating the dynamic time threshold is:

[0011] wherein n represents the total number of time periods, ρ i represents the network traffic density of the ith time period, represents the average network traffic density of n time periods, and k represents the window sensitivity adjustment coefficient.

[0012] In some embodiments of the application, determining the primary domain name and the slave domain name of each service based on each request sub-sequence comprises:

[0013] obtaining a similar domain name set corresponding to each request sub-sequence;

[0014] identifying the primary domain name and the slave domain name of each service in each similar domain name set.

[0015] In some embodiments of the application, obtaining a similar domain name set corresponding to each request sub-sequence comprises:

[0016] calculating the similar domain name set corresponding to each request sub-sequence based on the cosine similarity calculation method.

[0017] In some embodiments of the application, identifying the primary domain name and the slave domain name of each service in each similar domain name set comprises:

[0018] taking the domain name corresponding to the DNS request with the earliest request time in each similar domain name set as the primary domain name of each service;

[0019] generating each primary and slave domain name set based on the DNS request with domain name access frequency greater than a preset threshold in each similar domain name set;

[0020] determining the slave domain name of each service based on each primary and slave domain name set and each primary domain name.

[0021] In some embodiments of the application, determining the request sequence corresponding to each service request of each user based on each request record set of each user comprises:

[0022] The request record sets are divided into multiple request record sub-sets based on the second-level domain names of the DNS requests in the request record sets, and multiple DNS requests in each request record sub-set are sorted based on access time, to obtain a request sequence corresponding to each service request of each user.

[0023] In some embodiments of the present application, the network traffic density is calculated according to the following formula:

[0024]

[0025] wherein, ρ represents the network traffic density, D represents the total number of DNS requests, T represents the length of the time period, and A represents the preset area size.

[0026] In some embodiments of the present application, each master-slave domain name set is generated based on DNS requests in which the domain name in each similar domain name set has an access frequency greater than a preset threshold, and the method comprises the following steps:

[0027] counting the access frequencies of the domain names in each similar domain name set;

[0028] sorting the domain names based on the access frequencies;

[0029] when the difference between the access frequency of the first domain name and the access frequency of the second domain name is not less than half of the access frequency of the first domain name, generating a master-slave domain name set based on the first domain name and other domain names having an access frequency greater than that of the first domain name.

[0030] According to another aspect of the present application, a master-slave domain name identification system based on a dynamic sliding window is also disclosed, which comprises a processor, a memory and a computer program stored in the memory, the processor being configured to execute the computer program, and when the computer program is executed, the system implements the steps of the method according to any one of the above embodiments.

[0031] According to still another aspect of the present application, a computer readable storage medium is also provided, which stores a computer program, and when the computer program is executed by a processor, the steps of the method according to any one of the above embodiments are implemented.

[0032] The method for identifying master and slave domain names based on a dynamic sliding window disclosed in the embodiment of the application first calculates network traffic density, then determines a dynamic time threshold based on the network traffic density, further obtains each request subsequence by taking the dynamic time threshold calculated as a dynamic sliding window to obtain the corresponding DNS requests in each request sequence, and finally determines the master domain name and the slave domain name of each service based on each request subsequence. When the DNS requests in the window range are obtained based on the sliding window, the size of the sliding window is adaptively adjusted based on the change of the network traffic density, so that the DNS requests related to the service can be more accurately captured, and thus the identification accuracy of the master and slave domain names in the dynamically changing network environment is improved.

[0033] Additional advantages, objects, and features of the application will be set forth in part in the description which follows, and in part will become apparent to those skilled in the art upon examination of the following or can be learned by practice of the application. The objects and other advantages of the application can be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.

[0034] It will be understood by those skilled in the art that the objects and advantages of the present application can be realized and attained by the means set forth in the accompanying written description and claims, and that the objects and other advantages of the present application can be realized and attained by the means particularly pointed out in the written description and claims hereof as well as the appended drawings. BRIEF DESCRIPTION OF DRAWINGS

[0035] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments of the application and together with the description, serve to explain the principles of the application. The components in the drawings are not necessarily to scale, emphasis instead being placed upon illustrating the principles of the application. For purposes of clarity and understanding, it is expressly intended that some portions of the drawings be shown exaggerated in scale, or out of proportion, to illustrate aspects of the application. In the drawings:

[0036] Figure 1 The flowchart of the method for identifying master and slave domain names based on a dynamic sliding window according to an embodiment of the application.

[0037] Figure 2 The flowchart of the method for identifying master and slave domain names based on a dynamic sliding window according to another embodiment of the application. DETAILED DESCRIPTION

[0038] In order to make the objects, technical solutions and advantages of the present application clearer, further detailed description will be given to the present application in combination with the embodiments and drawings. Herein, the illustrative embodiments of the present application and the description thereof are used to explain the present application, but not as a limitation to the present application.

[0039] It should be noted that, in order not to obscure the present application with unnecessary details, only the structures and / or processing steps closely related to the solution according to the present application are shown in the drawings, while other details not relevant to the present application are omitted.

[0040] It should be emphasized that the terms "comprises / comprising" when used in this text, refer to the presence of the stated features, elements, steps or components, but do not preclude the presence or addition of one or more other features, elements, steps or components.

[0041] In order to solve the problem of low recognition accuracy of master and slave domain names in a dynamic network environment in the prior art based on the sliding window mechanism, the present application proposes a master and slave domain name recognition method and device based on a dynamic sliding window. This method adapts to different encrypted domain name network traffic and behavior patterns, dynamically adjusts the window size according to the real-time network traffic changes, thereby more accurately capturing the relevant domain name set, and further improving the recognition accuracy of master and slave domain names in a dynamic network environment. Understandably, the master and slave domain name recognition method based on a dynamic sliding window disclosed in the present application can be used for the recognition of traditional domain names, and also can be used for the recognition of encrypted domain names.

[0042] It should be noted that, if not otherwise specified, the term "connected" in this text can not only mean direct connection, but also indirect connection with intermediate substances.

[0043] In the following, embodiments of the present application will be described with reference to the accompanying drawings. In the drawings, the same reference numerals represent the same or similar parts or the same or similar steps.

[0044] Figure 1 The flowchart of the master and slave domain name recognition method based on a dynamic sliding window of an embodiment of the present application is shown in Figure 1 The master and slave domain name recognition method includes at least steps S10 to S40.

[0045] Step S10: Obtain DNS request records on the managed network boundary, divide the DNS request records into multiple user request record sets based on source IP addresses, and determine the request sequence corresponding to each service request of each user based on each user's request record set.

[0046] In this step, the DNS request records obtained on the managed network boundary are observed and parsed for domain name traffic, and all DNS requests are divided based on source IP to distinguish service access by different users; that is, this step divides all DNS requests on the managed network boundary into multiple request record sets, and the number of request record sets is equal to the number of users making service requests, so that the DNS request records are divided into multiple user request record sets based on source IP addresses.

[0047] After the request record set of each user is determined, the request sequence corresponding to each service request of each user is further determined based on the request record set of each user. Specifically, the DNS request in the request record set is a DNS request related to different services, so when determining the request sequence corresponding to each service request based on the request record set, the DNS request in the request record set is first divided based on the second-level domain name of the request domain name, so as to distinguish different service requests of the same user.

[0048] For example, the request sequence corresponding to each service request of each user is determined based on the request record set of each user, and specifically can include: dividing each request record set into a plurality of request record sub-sets based on the second-level domain name of each DNS request in each request record set, and sorting a plurality of DNS requests in each request record sub-set based on the access time to obtain the request sequence corresponding to each service request of each user. In this embodiment, each request record sub-set represents a service request of a user, and therefore each user has a plurality of request record sub-sets. In addition, all DNS requests in each request record sub-set are sorted according to the request timestamp, so that the request sequence corresponding to each request record sub-set can be obtained. It can be understood that the sorting manner of the DNS request in the request sequence is not limited, and can be descending order sorting or ascending order sorting based on the request time.

[0049] Step S20: obtaining the total number of DNS requests in the preset area and the time period length of the time period for DNS request statistics, and calculating the network flow density based on the total number of DNS requests, the time period length and the size of the preset area.

[0050] In this step, the network flow density is calculated based on the total number of DNS requests, the time period length and the size of the preset area. The flow density refers to the click volume from different IP addresses in a unit of time, and therefore the calculation of the network flow density is realized based on the total number of DNS requests of all users in the preset area in this step.

[0051] In an embodiment, the calculation formula of the network flow density is:

[0052]

[0053] Wherein, p represents network traffic density, D represents total number of DNS requests, T represents time period length, and A represents preset area size; in this embodiment, D is given as total data amount passing through the network within the time interval T under observation, and the preset area A is the network area size corresponding to the traffic of the current detected encrypted domain name (or non-encrypted domain name). It can be understood that the calculation method of network traffic density listed in this embodiment is only an example, and the network traffic density can also be calculated based on other methods.

[0054] Step S30: obtaining total number of time periods for DNS request statistics, and calculating a dynamic time threshold based on network traffic density corresponding to each time period and the total number of time periods.

[0055] In this step, the dynamic time threshold is adaptively calculated based on the size of network traffic density, so as to adaptively adjust the size of the sliding window based on the calculated dynamic time threshold. For example, the dynamic time threshold is composed of a reference time length and a dynamic adjustment factor.

[0056] In an embodiment, the calculation formula of the dynamic time threshold can be: Wherein, n represents total number of time periods, p represents network traffic density, and k represents window sensitivity adjustment coefficient. i represents network traffic density of the i th time period, represents average network traffic density of n time periods, and k represents window sensitivity adjustment coefficient. In this embodiment, is a reference value, represents average fluctuation degree of network density of a local time period relative to average network density of all time periods in the current preset area.

[0057] In the above embodiment, since the dynamic time threshold is calculated based on network traffic density, the dynamic time threshold will change as the network traffic density changes, so that when the DNS request is obtained based on the sliding window mechanism, the size of the sliding window is selected based on the calculated dynamic time threshold, thereby realizing dynamic adjustment of the sliding window.

[0058] Step S40: obtaining each request sub-sequence by obtaining at least part of the DNS requests in each request sequence based on the dynamic sliding window with the dynamic time threshold, and determining the master domain name and the slave domain name of each service based on each request sub-sequence.

[0059] In this step, each request sub-sequence is obtained from each request sequence with the dynamic time threshold calculated in step S30 as the size of the sliding window, and the primary domain name and the slave domain name of each service are further determined based on each request sub-sequence. In this step, the DNS requests in the request sub-sequence are part or all of the DNS requests in the request sequence, that is, the DNS request information in the request sub-sequence and the request sequence is arranged in ascending order or descending order based on the timestamp. For example, when the request sub-sequence is obtained by taking part of the DNS requests in the request sequence as the dynamic sliding window with the dynamic time threshold, the DNS requests in the sliding window range of the request sequence can be directly combined into the request sub-sequence.

[0060] In addition, the primary domain name and the slave domain name of each service are determined based on each request sub-sequence, which can specifically include the following steps: obtaining a similar domain name set corresponding to each request sub-sequence; identifying the primary domain name and the slave domain name of the service in each similar domain name set.

[0061] Further, the DNS requests in each similar domain name set are requests with high domain name similarity, and when the similar domain name set corresponding to each request sub-sequence is generated based on each request sub-sequence, the similar domain name set corresponding to each request sub-sequence can be calculated based on a cosine similarity calculation method; the cosine similarity calculation method measures the similarity by measuring the cosine value of the included angle of two vectors, and in this embodiment, the cosine similarity calculation method can be used to measure the similarity between two DNS requests to determine whether the two DNS requests are divided into the same similar domain name set. It should be understood that this embodiment is an implementation based on the cosine similarity calculation method to obtain the similar domain name set from the request sub-sequence, and in other embodiments, the similarity between DNS requests can also be calculated based on other methods.

[0062] In another embodiment, identifying the primary domain name and the slave domain name of the service in each similar domain name set includes: taking the domain name corresponding to the DNS request with the earliest request time in each similar domain name set as the primary domain name of each service; generating a primary-slave domain name set based on the DNS request with the domain name access frequency greater than a preset threshold in each similar domain name set; and determining the slave domain name of each service based on each primary-slave domain name set and each primary domain name. In this embodiment, the primary domain name and the slave domain name of the service are further identified from the similar domain name set, the primary domain name is the domain name with the earliest request time in the similar domain name set, and the other domain names in the primary-slave domain name set except the primary domain name are all slave domain names.

[0063] Specifically, the master-slave domain name set is generated based on the DNS requests with the domain name access times in each of the similar domain name sets being greater than a preset threshold, including: counting the access times of each domain name in each of the similar domain name sets; sorting the domain names based on the access times; and generating a master-slave domain name set based on a first domain name and other domain names with access times greater than the first domain name when the difference between the access times of the first domain name and the access times of a second domain name is not less than half of the access times of the first domain name. The embodiment discloses a step of generating a master-slave domain name set based on a similar domain name set. After sorting all domain names in the similar domain name set based on the access times of the domain names, if the total access times of a subsequent domain name (which can be understood as a second domain name) are attenuated by more than half of the occurrence times of a previous domain name (which can be understood as a first domain name), a master-slave domain name set is generated based on all domain names before the subsequent domain name. It can be understood that the total access times of each domain name before the subsequent domain name are all greater than the total access times of the subsequent domain name, and the total access times of each domain name before the subsequent domain name are all more than twice the total access times of the subsequent domain name.

[0064] In a specific embodiment, in order to extract the master domain name and the slave domain name of each service, first, the similar domain name set corresponding to each of the request subsequences can be calculated based on the cosine similarity calculation method, then the occurrence times of each domain name in all similar domain name sets are counted and arranged in descending order, and then they are compared in turn. If the occurrence times of a subsequent domain name are attenuated by more than half of the occurrence times of a previous domain name, the comparison is stopped, and the set formed by all domain names before the subsequent domain name is the master-slave domain name set corresponding to the service. In addition, the domain name with the earliest request timestamp in each similar domain name set is also counted. If a domain name is the earliest requested in its set in most cases, it is considered that the domain name is the master domain name corresponding to the service, and the other domain names in the master-slave domain name set are the slave domain names corresponding to the service. The similarity calculation of the domain name can be realized by using the existing cosine similarity calculation method, and can be realized by using the existing open source script.

[0065] It can be found from the above embodiments that the master-slave domain name identification method based on the dynamic sliding window of the application first calculates the network traffic density, then determines the dynamic time threshold based on the network traffic density, and then obtains at least part of the DNS requests in each request sequence by taking the calculated dynamic time threshold as the dynamic sliding window to obtain each request subsequence, and finally determines the master domain name and the slave domain name of each service based on each request subsequence. When the DNS requests in the window range are obtained based on the sliding window, the size of the sliding window is adaptively adjusted based on the change of the network traffic density, so that the DNS requests related to the service can be more accurately captured, and the identification accuracy of the master-slave domain name in the dynamically changing network environment is improved.

[0066] Figure 2This is a flowchart illustrating another embodiment of the master-slave domain name identification method based on a dynamic sliding window according to the present invention, as shown below. Figure 2 As shown, the master-slave domain identification method first observes and analyzes domain traffic in step S11 to distinguish service access from different users; then, in step S12, it sorts the second-level domains of each user according to timestamps; further, in step S13, it determines a dynamic sliding time window; finally, in step S14, it analyzes the master-slave domains based on the defined dynamic sliding time window, determines the master-slave domain set corresponding to the service and the master domain in the master-slave domain set from the set of similar domains, includes domains whose total access count within the time window exceeds a preset fixed number of times in the master-slave domain set domain analysis, and retains domains whose total access count does not reach the preset fixed number of times for the next comparison.

[0067] Specifically, in the process of observing and analyzing domain name traffic and distinguishing service access from different users, the DNS request records captured by the domain name monitoring system at the boundary of the managed network are first divided by source IP and decomposed into sets of DNS request records for different users to distinguish service access from different users. Then, domain name letter features are extracted from the request records, and the sets of DNS request records are further divided according to the second-level domain name of the request domain name, decomposed into multiple subsets of request records that are jointly corresponding to the user and the second-level domain name to distinguish different service accesses of the same user.

[0068] In the step of sorting the second-level domains of each user by timestamp, specifically, for each user's set of second-level domain records (subset of request records), sort the records by request timestamp within the set to obtain the DNS request sequence of each user's second-level domains.

[0069] In determining the dynamic sliding time window, specifically, the network traffic density is first calculated, and then the dynamic time threshold is calculated based on the calculated network traffic density.

[0070] In the master-slave domain identification step, the request subsequence extracted based on the dynamic sliding window is internally divided based on domain similarity. This involves analyzing domains whose request counts exceed a preset number within the time window, while retaining those that haven't reached the preset number for future comparison. Specifically, the master-slave domain set corresponding to the service and the master domain within the master-slave domain set are determined from the set of similar domains.

[0071] Accordingly, the present invention also provides a master-slave domain name identification system based on a dynamic sliding window, including a processor, a memory, and a computer program stored in the memory. The processor is used to execute the computer program, and when the computer program is executed, the system implements the steps of the method as described in any of the above embodiments.

[0072] The embodiment of the present application further provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the steps of the foregoing edge computing server deployment method. The computer readable storage medium can be a tangible storage medium, such as a random access memory (RAM), a memory, a read only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0073] Those of skill in the art would understand that the illustrative components, systems and methods described herein can be implemented in hardware, software, or a combination of hardware and software. The particular implementation techniques to be used to implement the present application should be readily apparent to those of skill in the art and the choice of these need not limit the practice of the present application. Different implementations of the present application can use more or less of the described components, systems and methods. Those of skill in the art will readily recognize a variety of ways to implement the application, and the application should not be construed as limited to the embodiments described herein. Embodiments of the present application can be implemented in hardware, firmware, software, or any combination thereof. Embodiments of the present application can also be implemented as instructions stored on a machine-readable medium, which can be read and executed by one or more processors. A machine-readable medium can include any mechanism for storing or transmitting information in a form readable by a machine, e.g., a computing device. For example, a machine-readable medium can include read only memory (ROM); random access memory (RAM); magnetic disk storage media; optical storage media; flash memory devices; electrical, optical, acoustical or other form of propagated signals (e.g., carrier waves, infrared signals, digital signals, etc.).

[0074] It is to be understood that the present application is not limited to the particular configurations, processing steps, and modifications described herein and illustrated in the drawings. Well-known methods have not been described or illustrated in detail in order to not unnecessarily obscure the present application. In the above-described embodiments, a number of specific steps are described and illustrated as examples. However, the methods of the present application are not limited to the specific steps described and illustrated, and one of skill in the art will be able to make various changes, modifications and additions thereto, or to change the order of steps, without departing from the spirit of the present application.

[0075] In the present application, features described and / or illustrated with respect to one embodiment can be used in the same or a similar way in one or more other embodiments, and / or in combination with or in place of features of other embodiments.

[0076] The preferred embodiments of the present application have been described above with the aid of numerous drawings. The above description is merely the preferred embodiment of the application. Modifications and variations of the application can be made by those of ordinary skill in the art without departing from the spirit and principles of the application. Accordingly, reference should be made to the appended claims for determining the scope of the application.

Claims

1. A method for identifying master and slave domain names based on a dynamic sliding window, characterized in that, The master-slave domain identification method includes: Obtain DNS request records on the boundary of the managed network, divide the DNS request records into multiple user request record sets based on the source IP address, and determine the request sequence corresponding to each service request of each user based on the request record set of each user. Obtain the total number of DNS requests within a preset area and the duration of the DNS request statistics period. Calculate the network traffic density based on the total number of DNS requests, the duration of the period, and the size of the preset area. Obtain the total number of time periods for DNS request statistics. Calculate a dynamic time threshold based on the network traffic density corresponding to each time period and the total number of time periods. The formula for calculating the dynamic time threshold is: Where n represents the total number of time periods; This represents the network traffic density in the i-th time period. This represents the average network traffic density over n time periods, and k represents the window sensitivity adjustment coefficient. Using the dynamic time threshold as a dynamic sliding window, at least a portion of the DNS requests within each request sequence are obtained to obtain each request subsequence. Based on each request subsequence, the primary domain name and secondary domain name of each service are determined.

2. The master-slave domain name identification method based on a dynamic sliding window according to claim 1, characterized in that, Based on each of the aforementioned request subsequences, the primary domain name and secondary domain name of each service are determined, including: Obtain the set of similar domain names corresponding to each of the aforementioned request subsequences; Identify the primary and secondary domains of services in each of the aforementioned sets of similar domains.

3. The master-slave domain name identification method based on a dynamic sliding window according to claim 2, characterized in that, Obtain the set of similar domain names corresponding to each of the aforementioned request subsequences, including: The set of similar domain names corresponding to each of the request subsequences is calculated based on the cosine similarity calculation method.

4. The master-slave domain name identification method based on a dynamic sliding window according to claim 2, characterized in that, Identifying the primary and secondary domains of services within each of the aforementioned sets of similar domains, including: The domain name corresponding to the earliest DNS request in each set of similar domain names is taken as the main domain name of each service. Each master-slave domain set is generated based on DNS requests to domains in each of the aforementioned similar domain sets whose access counts exceed a preset threshold. The slave domains of each service are determined based on the sets of master and slave domains and the master domains.

5. The master-slave domain name identification method based on a dynamic sliding window according to claim 1, characterized in that, Determining the request sequence corresponding to each service request of each user based on the request record set of each user includes: Based on the second-level domain name of each DNS request in each request record set, each request record set is divided into multiple request record subsets. The multiple DNS requests in each request record subset are sorted based on access time to obtain the request sequence corresponding to each service request of each user.

6. The master-slave domain name identification method based on a dynamic sliding window according to any one of claims 1 to 5, characterized in that, The formula for calculating the network traffic density is: ； in, The network traffic density is represented by D, the total number of DNS requests is represented by T, the time period is represented by A, and the preset zone size is represented by A.

7. The master-slave domain name identification method based on a dynamic sliding window according to claim 4, characterized in that, Each set of master and slave domains is generated based on DNS requests to domains in each of the aforementioned sets of similar domains that have access counts greater than a preset threshold, including: Count the number of visits to each domain in each of the aforementioned similar domain set; The domain names are sorted based on the number of visits mentioned above; When the difference between the number of visits to the first domain and the number of visits to the second domain is not less than half of the number of visits to the first domain, a set of master and slave domains is generated based on the first domain and other domains with a greater number of visits than the first domain.

8. A master-slave domain name identification system based on a dynamic sliding window, comprising a processor, a memory, and a computer program stored in the memory, characterized in that, The processor is configured to execute the computer program, and when the computer program is executed, the system implements the steps of the method as described in any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of the method as described in any one of claims 1 to 7.

Images