A domain name matching method, device and equipment

Abstract

The application provides a domain name matching method, device and equipment, the method comprises the following steps: obtaining a plurality of fuzzy domain names, the plurality of fuzzy domain names comprise a first type of fuzzy domain name, a second type of fuzzy domain name and a third type of fuzzy domain name; generating a first prefix tree based on the subdomain name in the first type of fuzzy domain name; performing a character reverse operation on the second type of fuzzy domain name to obtain a fourth type of fuzzy domain name; generating a second prefix tree based on the subdomain name in the fourth type of fuzzy domain name; generating a dictionary tree based on the subdomain name in the third type of fuzzy domain name; for each node in the first prefix tree, the second prefix tree and the dictionary tree, if the node is not the last level node, the node corresponds to a subnode array, the subnode array comprises the lower level node information of the node, and the lower level node information comprises the character index and the pointer of the lower level node; for each node in the dictionary tree, the node corresponds to the pointer of the mismatch node. Through the application scheme, the matching efficiency of the target domain name is improved, the matching performance is improved, and the matching time is reduced.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a domain name matching method, apparatus and device. Background Technology

[0002] Network devices (such as routers and switches) distribute a large number of fuzzy domain names in substring format. When a network device receives a DNS (Domain Name System) response message from a DNS server, it can resolve the domain name to be matched and the IP address (i.e., the IP address corresponding to the domain name to be matched) from the DNS response message. If the domain name to be matched successfully matches any fuzzy domain name, the IP address is stored; if the domain name to be matched fails to match any fuzzy domain name, the IP address is not stored. Based on this, the stored IP addresses can be used as legitimate IP addresses. The network device allows data packets accessing legitimate IP addresses and discards data packets accessing illegitimate IP addresses, thereby achieving data packet access control.

[0003] For example, suppose the fuzzy domain name includes the rule string "xiao". If the domain name to be matched includes the data string "xiaoyi", then the data string "xiaoyi" matches the rule string "xiao". If the domain name to be matched includes the data string "xiamen", then the data string "xiamen" does not match the rule string "xiao". Alternatively, suppose the fuzzy domain name includes the rule string "xia", then both the data strings "xiaoyi" and "xiamen" match the rule string "xia".

[0004] However, when issuing a large number of fuzzy domain names, it is necessary to match each fuzzy domain name with the domain name to be matched in turn, which takes a long time and has low matching performance, and the matching performance cannot meet the actual needs. Summary of the Invention

[0005] This application provides a domain name matching method, the method comprising:

[0006] Multiple fuzzy domain names are obtained, each fuzzy domain name includes fuzzy characters and subdomains; the multiple fuzzy domain names include a first type of fuzzy domain name, a second type of fuzzy domain name, and a third type of fuzzy domain name; the fuzzy characters in the first type of fuzzy domain name are located after the subdomains, the fuzzy characters in the second type of fuzzy domain name are located before the subdomains, and the fuzzy characters in the third type of fuzzy domain name are located both before and after the subdomains;

[0007] A first prefix tree is generated based on the subdomains in the first type of fuzzy domain name, and the first prefix tree includes multi-level nodes;

[0008] A fourth type of fuzzy domain name is obtained by performing a character reversal operation on the second type of fuzzy domain name; a second prefix tree is generated based on the subdomains in the fourth type of fuzzy domain name, and the second prefix tree includes multi-level nodes;

[0009] A trie is generated based on the subdomains in the third type of fuzzy domain name, and the trie includes multi-level nodes;

[0010] For each node in the first prefix tree, the second prefix tree, and the trie, if the node is not the last-level node, then the node corresponds to a child node array, the child node array includes the information of the node's subordinate nodes, and the information of the subordinate nodes includes the character index and pointer of the subordinate nodes;

[0011] For each node in the trie, there is a pointer to a mismatched node;

[0012] The first prefix tree, the second prefix tree, and the trie are used to match the acquired target domain name and perform processing corresponding to the matching result based on the target domain name.

[0013] This application provides a domain name matching device, the device comprising:

[0014] The acquisition module is used to acquire multiple fuzzy domain names, each fuzzy domain name including fuzzy characters and subdomains; the multiple fuzzy domain names include a first type of fuzzy domain name, a second type of fuzzy domain name, and a third type of fuzzy domain name; the fuzzy characters in the first type of fuzzy domain name are located after the subdomain, the fuzzy characters in the second type of fuzzy domain name are located before the subdomain, and the fuzzy characters in the third type of fuzzy domain name are located both before and after the subdomain;

[0015] The generation module is used to generate a first prefix tree based on the subdomains in the first type of fuzzy domain name, wherein the first prefix tree includes multi-level nodes;

[0016] A fourth type of fuzzy domain name is obtained by performing a character reversal operation on the second type of fuzzy domain name; a second prefix tree is generated based on the subdomains in the fourth type of fuzzy domain name, and the second prefix tree includes multi-level nodes;

[0017] A trie is generated based on the subdomains in the third type of fuzzy domain name, and the trie includes multi-level nodes;

[0018] For each node in the first prefix tree, the second prefix tree, and the trie, if the node is not the last-level node, then the node corresponds to a child node array, the child node array includes the information of the node's subordinate nodes, and the information of the subordinate nodes includes the character index and pointer of the subordinate nodes;

[0019] For each node in the trie, there is a pointer to a mismatched node;

[0020] The detection module is used to match the acquired target domain name based on the first prefix tree, the second prefix tree, and the trie, and to perform processing corresponding to the matching result based on the target domain name.

[0021] This application provides a network device, including: a processor and a machine-readable storage medium, the machine-readable storage medium storing machine-executable instructions that can be executed by the processor; the processor is used to execute the machine-executable instructions to implement the domain name matching method of the above example of this application.

[0022] This application provides a computer program product, which may include a computer program that, when executed by a processor, implements the domain name matching method executorified above in this application.

[0023] This application provides a machine-readable storage medium storing machine-executable instructions that can be executed by a processor; wherein the processor is used to execute the machine-executable instructions to implement the domain name matching method of the above example of this application.

[0024] As can be seen from the above technical solutions, in this embodiment, all fuzzy domain names can be divided into three categories: first-class fuzzy domain names, second-class fuzzy domain names, and third-class fuzzy domain names. A first prefix tree is generated based on the first-class fuzzy domain names, a second prefix tree is generated based on the second-class fuzzy domain names, and a trie is generated based on the third-class fuzzy domain names. In this way, the target domain name can be matched using the first prefix tree, the second prefix tree, and the trie, thereby improving the matching efficiency of the target domain name, enhancing matching performance, reducing matching time, and meeting practical needs. In scenarios with a large number of fuzzy domain names, the matching speed of fuzzy domain names can be improved, enabling rapid response to the target domain name, and significantly enhancing matching performance. Attached Figure Description

[0025] Figure 1 This is a flowchart illustrating a domain name matching method in one embodiment of this application;

[0026] Figure 2 This is a schematic diagram illustrating the use of the strstr function for domain name matching in one embodiment of this application;

[0027] Figure 3A and Figure 3B This is a schematic diagram of the structure of the first prefix tree in one embodiment of this application;

[0028] Figures 4A-4G This is a schematic diagram of the trie structure in one embodiment of this application;

[0029] Figure 5AThis is a schematic diagram of the DNS Snooping function in one embodiment of this application;

[0030] Figure 5B This is a schematic diagram of the DNS redirection function in one embodiment of this application;

[0031] Figure 6 This is a schematic diagram of the domain name matching device in one embodiment of this application;

[0032] Figure 7 This is a hardware structure diagram of a network device according to one embodiment of this application. Detailed Implementation

[0033] This application proposes a domain name matching method that can be applied to network devices (such as routers, switches, etc.).

[0034] See Figure 1 The diagram shown is a flowchart of the method, which may include:

[0035] Step 101: Obtain multiple fuzzy domain names. Each fuzzy domain name includes fuzzy characters and subdomains. The multiple fuzzy domain names include first-type fuzzy domain names, second-type fuzzy domain names, and third-type fuzzy domain names. In the first-type fuzzy domain name, the fuzzy characters are located after the subdomains. In the second-type fuzzy domain name, the fuzzy characters are located before the subdomains. In the third-type fuzzy domain name, the fuzzy characters are located both before and after the subdomains.

[0036] Step 102: Generate a first prefix tree based on the subdomains of the first type of fuzzy domain. The first prefix tree may include multi-level nodes. Perform character reversal operations on the second type of fuzzy domain to obtain a fourth type of fuzzy domain. Generate a second prefix tree based on the subdomains of the fourth type of fuzzy domain. The second prefix tree may include multi-level nodes. Generate a trie based on the subdomains of the third type of fuzzy domain. The trie may include multi-level nodes.

[0037] In one example, for each node in the first prefix tree, second prefix tree, and trie, if the node is not the last-level node, then the node can correspond to an array of child nodes. This array of child nodes includes information about the node's lower-level nodes, and the lower-level node information can include the character index and pointer of the lower-level node. Furthermore, for each node in the trie, the node can correspond to a pointer to a mismatched node.

[0038] In one example, the first prefix tree, the second prefix tree, and the trie are used to match the obtained target domain name and perform the corresponding processing based on the target domain name and the matching result.

[0039] In one example, the character index of a child node in the child node array is obtained by querying a configured compressed table using the character of the child node. This compressed table can include a mapping between characters and character indices. Furthermore, for both uppercase and lowercase versions of the same character, they can correspond to the same character index in the compressed table.

[0040] In one example, the process of determining the unmatched node for each node in the trie may include, but is not limited to: if the parent node of the node is the root node, then the root node can be determined as the unmatched node of the node. If the parent node of the node is not the root node, then the unmatched node of the parent node can be determined as the current node, and it is determined whether there is a target node in the lower-level nodes of the current node. The character index of the target node can be the same as the character index of the current node. If yes, then the target node can be determined as the unmatched node of the node; if no, then it is determined whether the current node is the root node; if the current node is the root node, then the root node can be determined as the unmatched node of the node; if the current node is not the root node, then the unmatched node of the current node can be updated to the current node, and the operation of determining whether there is a target node in the lower-level nodes of the current node can be repeated until the unmatched node of the node is obtained.

[0041] In one example, after identifying the mismatched node for each node in the trie, if a node to be optimized exists among all nodes in the trie, then that node can be selected from all nodes in the trie, with the child nodes of the node to be optimized being the same as the child nodes of the mismatched node of the node to be optimized. For each node to be optimized, the mismatched node of the mismatched node of that node is identified as the current node. It is then determined whether a target node exists among the child nodes of the current node. If so, the target node is updated to the mismatched node of the node to be optimized. If not, it is determined whether the current node is the root node. If the current node is the root node, it is updated to the mismatched node of the node to be optimized. If the current node is not the root node, the mismatched node of the current node is updated to the current node. This process of determining whether a target node exists among the child nodes of the current node is repeated until the mismatched node of the node to be optimized is obtained.

[0042] In one example, the matching process for a target domain name may include: obtaining the target domain name; if the target domain name matches one of the first prefix tree, the second prefix tree, and the trie, then the matching result of the target domain name is determined to be a successful match, and the corresponding processing is performed based on the target domain name.

[0043] Alternatively, if the target domain name fails to match the first prefix tree, the second prefix tree, and the trie, then the matching result of the target domain name is determined to be a match failure, and the corresponding processing is performed based on the target domain name.

[0044] The matching process between the target domain name and the first prefix tree includes: if, based on the child node array corresponding to each node in the first prefix tree, it is determined that the first K1 characters of the target domain name are the same as the character indices of the K1 nodes of the first prefix tree, then the target domain name is determined to be successfully matched with the first prefix tree; otherwise, the target domain name is determined to be unmatched with the first prefix tree. The K1 nodes include one node at each level from the first level to the last level.

[0045] The matching process between the target domain name and the second prefix tree may include: performing a character reverse operation on the target domain name to obtain the reverse domain name corresponding to the target domain name; if, based on the child node array corresponding to each node in the second prefix tree, it is determined that the first K2 characters of the reverse domain name are the same as the character indices of the K2 nodes of the second prefix tree, then the target domain name is determined to be successfully matched with the second prefix tree; otherwise, the target domain name is determined to be unmatched with the second prefix tree; wherein, the K2 nodes include one node at each level from the first level to the last level.

[0046] The matching process between the target domain name and the trie can include: if, based on the child node arrays corresponding to each node in the trie and the pointers to the mismatched nodes, it is determined that the first K3 characters of the target domain name are the same as the character indices of the K3 nodes in the trie, then the target domain name is determined to be a successful match with the trie; otherwise, the target domain name is determined to be a failed match with the trie. Here, the K3 nodes include one node from each level from the first level to the last level; or, the K3 nodes include one node from each level from the first level to the Mth level, and one node from the next level of the mismatched node of the Mth level to the last level, where the Mth level is not the last level.

[0047] In one example, the processing based on the target domain name for a successful match, or the processing based on a failed match, can include, but is not limited to: if the target domain name is successfully matched, the IP address of the application server corresponding to the target domain name can be obtained and recorded in the forwarding table; if the target domain name is unsuccessfully matched, recording the IP address of the target domain name in the forwarding table can be prevented. Based on this, when an access packet is received, if the forwarding table includes the destination IP address of the access packet, the access packet can be forwarded to the application server corresponding to the destination IP address; if the forwarding table does not include the destination IP address of the access packet, the access packet is intercepted.

[0048] Alternatively, if the target domain name in the domain name request message matches successfully, the destination IP address of the domain name request message is modified. The original destination IP address is the IP address of the first domain name server, and the modified destination IP address is the IP address of the second domain name server. Based on the modified destination IP address, the domain name request message is sent to the second domain name server, which determines the IP address of the application server corresponding to the target domain name. If the target domain name in the domain name request message does not match successfully, the domain name request message is sent to the first domain name server based on the destination IP address, which determines the IP address of the application server corresponding to the target domain name.

[0049] As can be seen from the above technical solutions, in this embodiment, all fuzzy domain names can be divided into three categories: first-class fuzzy domain names, second-class fuzzy domain names, and third-class fuzzy domain names. A first prefix tree is generated based on the first-class fuzzy domain names, a second prefix tree is generated based on the second-class fuzzy domain names, and a trie is generated based on the third-class fuzzy domain names. In this way, the target domain name can be matched using the first prefix tree, the second prefix tree, and the trie, thereby improving the matching efficiency of the target domain name, enhancing matching performance, reducing matching time, and meeting practical needs. In scenarios with a large number of fuzzy domain names, the matching speed of fuzzy domain names can be improved, enabling rapid response to the target domain name, and significantly enhancing matching performance.

[0050] The technical solutions described above in the embodiments of this application will be explained below in conjunction with specific application scenarios.

[0051] Network devices (such as routers and switches) distribute a large number of fuzzy domain names (partial contents of complete domain names) and a large number of exact domain names (complete domain names) as substrings, supporting mixed configurations of fuzzy and exact domain names. When a network device receives a DNS response message from a DNS server, it resolves the domain name to be matched and the IP address (the IP address corresponding to the domain name to be matched) from the DNS response message. If the domain name to be matched successfully matches any fuzzy or exact domain name, the IP address is stored in the security table entry. If the domain name to be matched fails to match any fuzzy or exact domain name, the IP address is not stored in the security table entry. Based on this, the security device allows data packets accessing IP addresses in the security table entry and discards data packets accessing IP addresses outside the security table entry, thus implementing access control for data packets.

[0052] When matching a domain name to be matched against a fuzzy or precise domain name, you can use the function `strstr` (which returns the address of the first occurrence of a substring in a string) or the function `strcasestr` (which searches for another string within a string). The functions `strstr` and `strcasestr` are used for substring matching within strings.

[0053] For example, see Figure 2 The diagram illustrates the use of the `strstr` function for domain name matching. The domain name to be matched can be abe.com, and the four fuzzy domain names are *abd*, *ac*, *bcd*, and *be*. First, the `strstr` function matches the domain name "abe.com" with the fuzzy domain name "*abd*", and the result is no match (i.e., a failed match). Then, the `strstr` function matches the domain name "abe.com" with the fuzzy domain name "*ac*", and the result is no match (again). Next, the `strstr` function matches the domain name "abe.com" with the fuzzy domain name "*bcd*", and the result is no match (again). Finally, the `strstr` function matches the domain name "abe.com" with the fuzzy domain name "*be*", and the result is a match (i.e., a successful match).

[0054] In summary, it is necessary to iterate through each fuzzy domain name in turn, and then use each fuzzy domain name to match the domain name "abe.com". When there are a large number of fuzzy domain names, the matching efficiency is relatively low, the matching time is very long, the matching performance is relatively low, and the matching performance cannot meet the actual needs.

[0055] In response to the above findings, this application proposes a domain name matching method to improve the matching speed of fuzzy domain names in scenarios with a large number of fuzzy domain names, achieve rapid response, and improve the matching efficiency of fuzzy domain names.

[0056] In this embodiment of the application, the network device can obtain multiple fuzzy domain names, and the multiple fuzzy domain names can include a first type of fuzzy domain name, a second type of fuzzy domain name, and a third type of fuzzy domain name. That is, all fuzzy domain names can be distinguished into a first type of fuzzy domain name, a second type of fuzzy domain name, and a third type of fuzzy domain name.

[0057] In one example, each fuzzy domain name can include fuzzy characters and subdomains. In the first type of fuzzy domain name, the fuzzy characters can be placed after the subdomain. In the second type of fuzzy domain name, the fuzzy characters can be placed before the subdomain. In the third type of fuzzy domain name, the fuzzy characters can be placed both before and after the subdomain.

[0058] For example, regarding fuzzy domain names such as ab*, ac*, bc*, and bd*, ab, ac, bc, and bd represent subdomains, and * represents fuzzy characters (i.e., wildcards, indicating that they match all characters). In other words, fuzzy characters can be placed after subdomains. Therefore, fuzzy domain names such as ab*, ac*, bc*, and bd* are classified as first-class fuzzy domain names.

[0059] For example, regarding fuzzy domains such as *ba, *ca, *cb, and *db, ba, ca, cb, and db represent subdomains, and * represents a fuzzy character (i.e., a wildcard, indicating a match with all characters). This means that fuzzy characters can be placed before subdomains. Therefore, fuzzy domains such as *ba, *ca, *cb, and *db are classified as second-category fuzzy domains.

[0060] For example, regarding fuzzy domain names such as *abd*, *ac*, *bcd*, and *be*, abd, ac, bcd, and be represent subdomains, and * represents a fuzzy character (i.e., a wildcard). This means that a fuzzy character can appear both before and after a subdomain. Therefore, fuzzy domain names such as *abd*, *ac*, *bcd*, and *be* are classified as third-category fuzzy domain names.

[0061] First, based on all first-class fuzzy domain names, a first prefix tree can be generated from the subdomains within these first-class fuzzy domain names. The first prefix tree begins with a specified string and includes multi-level nodes. By constructing the first prefix tree for all first-class fuzzy domain names, the fuzzy domain name matching process can be optimized.

[0062] For example, for first-class fuzzy domains such as ab*, ac*, bc*, and bd*, the subdomains within these first-class fuzzy domains are ab, ac, bc, and bd, respectively. These four subdomains begin with the characters 'a' and 'b'. Therefore, there are two first-level nodes under the root node: node 'a' and node 'b'. For the first-level node 'a', since 'a' contains the characters 'b' and 'c', there can be two second-level nodes under it: nodes 'b' and 'c'. Similarly, for the first-level node 'b', since 'b' contains the characters 'c' and 'd', there can be two second-level nodes under it: nodes 'c' and 'd'.

[0063] In summary, a first prefix tree can be constructed; see [link to documentation]. Figure 3A The diagram shown illustrates the structure of a first prefix tree. A first prefix tree can include a root node (also called the root node) and two levels of nodes. The first-level nodes include node 'a' and node 'b', and the second-level nodes include nodes 'b' and 'c' under node 'a', and nodes 'c' and 'd' under node 'b'. Of course, Figure 3A This is just an example; the first prefix tree can include multi-level nodes, such as for fuzzy domain names like abcdef*, where the first prefix tree can include six levels of nodes.

[0064] In one example, for each node in the first prefix tree, if the node is not the last level node of the first prefix tree, then the node can correspond to an array of child nodes. The array of child nodes includes the information of the lower-level nodes of the node, and the information of the lower-level nodes can include the character index and pointer of the lower-level nodes.

[0065] If the node is the last-level node, it can correspond to an array of child nodes, but the array of child nodes is empty, that is, it does not include pointers to lower-level nodes. Alternatively, the node may not correspond to an array of child nodes.

[0066] In one example, consider the array of child nodes corresponding to a given node, as shown in Table 1 or Table 2. In Table 1, the child node array can include all character indices. For character indices of lower-level nodes, the pointer corresponding to that character index is a real value, meaning it points to the next-level node. For character indices of non-lower-level nodes, the pointer corresponding to that character index is NULL, meaning it does not point to the next-level node and is an invalid value.

[0067] In Table 2, the child node array only includes the character index of the lower-level node, and the pointer corresponding to the character index is the actual value, that is, the pointer corresponding to the character index points to the next level node.

[0068] Table 1

[0069] Character Index 0 1 … 12 13 14 15 … pointer NULL NULL … X1 X2 NULL NULL …

[0070] Table 2

[0071] Character Index 12 13 pointer X1 X2

[0072] As can be seen from the child node arrays in Table 1 or Table 2, this node can correspond to two child nodes. The character index of the first child node is 12, and its pointer is X1. That is, the child node with character index 12 can be found through pointer X1. The character index of the second child node is 13, and its pointer is X2. That is, the child node with character index 13 can be found through pointer X2.

[0073] In one example, the character index of a child node in the child node array can be the ASCII code (e.g., 0-255) corresponding to the character of the child node. For instance, if the character of the child node is 'a', the character index of child node 'a' is 97 (the ASCII code of character 'a' is 97); if the character of the child node is 'b', the character index of child node 'b' is 98 (the ASCII code of character 'b' is 98), and so on. Clearly, since there are 256 possible ASCII values ​​(0-255), there are a total of 256 character indices for the child node array in Table 1; that is, each node's child node array corresponds to 256 character indices.

[0074] In one example, considering that a domain name consists of a fixed number of characters, such as characters 0-9, lowercase characters a-z, uppercase characters A-Z, characters "-", characters "_", and characters ".", and that domain names are not case-sensitive, a static mapping can be performed to map the fixed number of characters that make up the domain name to the numbers 0-38.

[0075] For example, a compression table can be pre-configured, which can include the mapping relationship between characters and character indices. For instance, characters 0-9 correspond to character indices 0-9, lowercase characters a-z correspond to character indices 10-35, and uppercase characters A-Z correspond to character indices 10-35. That is, for the same uppercase and lowercase character, they can correspond to the same character index in the compression table. For example, lowercase character a and uppercase character A both correspond to character index 10, lowercase character b and uppercase character B both correspond to character index 11, and so on. Furthermore, the character "-" corresponds to character index 36, the character "_" corresponds to character index 37, and the character "." corresponds to character index 38. Thus, there are a total of 39 character indices. Of course, the above is just an example of characters and character indices, and there are no restrictions on this mapping relationship.

[0076] The character index of a child node in the child node array is obtained by querying the compressed table for the character of the child node. For example, if the character of the child node is 'a', the character index of child node 'a' is 10 (the character index of 'a' in the compressed table is 10). If the character of the child node is 'b', the character index of child node 'b' is 11 (the character index of 'b' in the compressed table is 11), and so on. Clearly, since the compressed table contains 39 values ​​(e.g., 0-38), there are a total of 39 character indices for the child node array of Table 1; that is, each node's child node array corresponds to 39 character indices.

[0077] For example, see Figure 3B The diagram shows the structure of the first prefix tree. For each node in the first prefix tree, there is a corresponding array of child nodes, and this array of child nodes contains 39 character indices. For the character indices of lower-level nodes, the pointer corresponding to that index is the actual value, meaning the pointer points to the next-level node. For the character indices of non-lower-level nodes, the pointer corresponding to that index is NULL. For the child node array of the last-level node, all pointers corresponding to character indices are NULL.

[0078] By configuring a compression table to map characters 0-9, lowercase characters a-z, uppercase characters A-Z, the character "-", the character "_", and the character "." to character indices 0-38, the problem of case-insensitive domain names can be solved. That is, uppercase and lowercase characters of the same letter are mapped to the same character index, and the node memory is significantly reduced, with the child node array reduced from 256 elements to 39 elements.

[0079] In one example, based on Figure 3B The matching process between the target domain name (source is described in subsequent embodiments) and the first prefix tree shown includes: if, based on the child node arrays corresponding to each node in the first prefix tree, the first K1 characters of the target domain name are found to have the same character indices as the K1 nodes of the first prefix tree, then the target domain name is determined to be a successful match with the first prefix tree; otherwise, the target domain name is determined to be a failed match with the first prefix tree. The K1 nodes include one node at each level from the first level to the last level. When the first prefix tree includes two levels of nodes, K1 is 2; when the first prefix tree includes three levels of nodes, K1 is 3, and so on.

[0080] For example, assuming the target domain is bdx.abc.com, first find the first character "b" in the target domain, and the character index of the character "b" is 11. In the root node's child node array, there exists a pointer corresponding to character index 11. Based on this pointer, find the first-level node b. Obviously, the character "b" in the target domain has the same character index as the first-level node b. After finding the first-level node b, determine whether the first-level node b is the last-level node. If not, find the second character "d" in the target domain.

[0081] The character index of the character "d" is 13. In the child node array of the first-level node b, there exists a pointer corresponding to character index 13. Based on this pointer, the second-level node d is found. The character "d" in the target domain name has the same character index as the second-level node d. After finding the second-level node d, it is determined whether the second-level node d is the last-level node. If so, the traversal process ends, confirming that the target domain name matches the first prefix tree successfully. In summary, based on the child node arrays corresponding to each node in the first prefix tree, it is determined that the first two characters of the target domain name have the same character index as two nodes in the first prefix tree. These two nodes represent one node from each level from the first to the last, i.e., the first-level node b and the second-level node d, with the second level being the last level. For "x.abc.com" in the target domain name, it corresponds to the "*" in the fuzzy domain name and does not need to be matched with any nodes in the first prefix tree.

[0082] For example, suppose the target domain name is bex.abc.com. First, find the first character "b" in the target domain name. Based on the child node array of the root node, find the first-level node b. The first-level node b is not the last-level node. Then, find the second character "e" in the target domain name. In the child node array of the first-level node b, there is no pointer to the character "e". Therefore, it is determined that the target domain name fails to match the first prefix tree.

[0083] In summary, when the first prefix tree includes two levels of nodes, the matching process can be completed in two steps: from the root node to node b (corresponding to character index 11), and then from node b to node d (corresponding to character index 13). Even if there are 1000 fuzzy domain names, the matching is completed in two steps. This is related to the number of levels of nodes in the first prefix tree and is not related to the number of fuzzy domain names, thus improving the matching efficiency.

[0084] Second, based on all second-type fuzzy domain names, character reversal operations can be performed on these domain names to obtain fourth-type fuzzy domain names. A second prefix tree, also called a suffix tree, is then generated based on the subdomains within the fourth-type fuzzy domain names. The second prefix tree ends with a specified string and includes multi-level nodes. By constructing the second prefix tree for all second-type fuzzy domain names, the fuzzy domain name matching process can be optimized.

[0085] Reversing the characters in the second type of fuzzy domain name means iterating through each character sequentially, starting from the last character of the second type of fuzzy domain name, and combining these characters in the order of iteration to form the fourth type of fuzzy domain name. For example, the last character of the second type of fuzzy domain name becomes the first character of the fourth type of fuzzy domain name, the second-to-last character becomes the second character, the third-to-last character becomes the third character, and so on.

[0086] For example, for second-type fuzzy domains such as *ba, *ca, *cb, and *db, we first perform character reversal operations on these second-type fuzzy domains to obtain fourth-type fuzzy domains. For instance, the fourth-type fuzzy domain corresponding to *ba is ab, *ca is ac, *cb is bc, and *db is bd*. Clearly, the subdomains in these fourth-type fuzzy domains are ab, ac, bc, and bd, respectively. The process of constructing a second prefix tree based on the subdomains in the fourth-type fuzzy domains is similar to the process of constructing a first prefix tree based on the subdomains in the first-type fuzzy domains, and will not be repeated here. For the constructed second prefix tree, see [link to documentation]. Figure 3A and Figure 3B The diagram shown is a schematic of the second prefix tree.

[0087] In one example, for each node in the second prefix tree, if the node is not the last-level node of the second prefix tree, then the node can correspond to an array of child nodes. This array of child nodes includes information about the node's child nodes, and the information about the child nodes can include the character index and pointer of the child nodes. If the node is the last-level node, then the node can correspond to an array of child nodes, but this array of child nodes is empty, that is, it does not include pointers to child nodes. Alternatively, the node may not correspond to an array of child nodes.

[0088] For example, the child node array can include all character indices. For a character index of a child node, the pointer corresponding to that index points to the next level node. For a character index of a non-child node, the pointer corresponding to that index is NULL. Alternatively, the child node array can only include the character indices of child nodes, and the pointers corresponding to those character indices point to the next level node. For example, the character index of a child node in the child node array is obtained by looking up the compressed table of the child node's characters.

[0089] In one example, the matching process between a target domain name and a second prefix tree, based on the second prefix tree, can include: performing a character reversal operation on the target domain name to obtain the corresponding reverse domain name; if, based on the child node arrays corresponding to each node in the second prefix tree, the first K2 characters of the reverse domain name are the same as the character indices of the K2 nodes in the second prefix tree, then the target domain name is determined to be a successful match with the second prefix tree; otherwise, the target domain name is determined to be a failed match with the second prefix tree. The K2 nodes include one node from each level from the first level to the last level. When the second prefix tree includes two levels of nodes, K2 is 2, and so on.

[0090] Reversing the characters of a target domain name means iterating through each character of the target domain name sequentially, starting from the last character, and combining these characters in the order of iteration to form the reverse domain name. For example, the last character of the target domain name becomes the first character of the reverse domain name, the second-to-last character becomes the second character, and so on. For instance, reversing the characters of the target domain name abc.com.db yields the reverse domain name bd.moc.cba.

[0091] After obtaining the reverse domain bd.moc.cba, it is possible to match the reverse domain bd.moc.cba with the second prefix tree. The matching process between the reverse domain bd.moc.cba and the second prefix tree is similar to the matching process between the target domain and the first prefix tree, and will not be repeated here. Based on the matching result of the reverse domain bd.moc.cba and the second prefix tree, it can be determined that the target domain abc.com.db matches the second prefix tree successfully, or it can be determined that the target domain abc.com.db fails to match the second prefix tree.

[0092] Third, based on all third-category fuzzy domain names, a trie can be generated from the subdomains within these domains. This trie can contain specified strings and can include multi-level nodes. By constructing a trie for all third-category fuzzy domain names, the fuzzy domain name matching process can be optimized.

[0093] The process of constructing a trie based on subdomains of third-category fuzzy domains is similar to the process of constructing a first prefix tree based on subdomains of first-category fuzzy domains, and will not be repeated here. For example, for third-category fuzzy domains such as *abd*, *ac*, *bcd*, and *be*, a trie can be constructed... Figure 4A The trie shown.

[0094] In one example, for each node in the trie, if the node is not the last-level node of the trie, then the node can correspond to an array of child nodes. This array of child nodes includes information about the node's child nodes, and the information about the child nodes can include the character index and pointer of the child nodes. If the node is the last-level node of the trie, then the node can correspond to an array of child nodes, but this array of child nodes is empty, that is, it does not include pointers to child nodes. Alternatively, the node may not correspond to an array of child nodes.

[0095] For example, the child node array can include all character indices. For a character index of a child node, the pointer corresponding to that index points to the next level node. For a character index of a non-child node, the pointer corresponding to that index is NULL. Alternatively, the child node array can only include the character indices of child nodes, and the pointers corresponding to those character indices point to the next level node. For example, the character index of a child node in the child node array is obtained by looking up the compressed table of the child node's characters.

[0096] In one example, for each node in the trie, in addition to the corresponding array of child nodes, the node can also correspond to a pointer to a mismatch node (which can be called a match failure pointer). That is, match failure pointers are added to the nodes of the trie, thereby achieving efficient matching through match failure pointers.

[0097] See Figure 4BThe diagram illustrates adding a match failure pointer to each node in a trie. For each node, Figure 4B The blue arrow in the image points to the parent node of this node. Figure 4B The red arrows in the diagram point to the mismatched node of that node; in other words, the red arrows represent pointers to failed matches, and the mismatched node pointed to by the red arrows is the starting position for the next match. For each node, the failed match pointers can be filled using a breadth-first traversal. For example, for node 'a' in the first level, a breadth-first traversal can be used to reach the root node as the mismatched node, and the pointer from node 'a' to the mismatched node serves as a failed match pointer. For node 'b' in the second level, a breadth-first traversal can be used to reach node 'b' in the first level as the mismatched node, and the pointer from node 'b' in the second level to the mismatched node (i.e., node 'b' in the first level) serves as a failed match pointer, and so on.

[0098] For each node, the mismatch node is the longest suffix node from the root node to that node, as shown below. Figure 4C The trie shown illustrates how mismatched nodes work. See also Figure 4C The diagram shows a trie, which includes the fuzzy domains abd and bcd, with the target domain being abcd.com.

[0099] In the first matching process, the first character "a" of the target domain name matches the first-level node a, that is, it matches the first-level node a. The second matching process is then performed based on the lower-level nodes of the first-level node a.

[0100] In the second matching process, the second character "b" of the target domain name hits the lower-level node b of the first-level node a, that is, the second character "b" of the target domain name hits the second-level node b, that is, it matches the second-level node b. The third matching process is then performed based on the lower-level nodes of the second-level node b.

[0101] In the third matching process, the third character "c" of the target domain name does not match any of the child nodes of the second-level node b, meaning there is no node c under the second-level node b. Based on this, instead of directly determining that the target domain name "abcd.com" fails to match the trie, it is necessary to find the mismatch node of the second-level node b, which is the first-level node b. Then, it is determined whether the third character "c" of the target domain name exists under the mismatch node of the second-level node b. Since the third character "c" of the target domain name exists under the mismatch node, the second character "b" of the target domain name matches the mismatch node of the second-level node b, which means it matches the first-level node b. The fourth matching process is then performed based on the child nodes of the first-level node b.

[0102] In the fourth matching process, the third character "c" of the target domain name matches the lower-level node c of the first-level node b, and the fifth matching process is performed based on the lower-level node c of the second-level node.

[0103] In the fifth matching process, the fourth character "d" of the target domain name hits the lower-level node d of the second-level node c. Since the third-level node d is the last-level node, the last-level node of the trie is successfully matched, and the matching process is completed. The target domain name "abcd.com" is successfully matched with the trie.

[0104] In summary, by maintaining mismatch nodes in the trie, the target domain "abcd.com" can be matched with the fuzzy domain "bcd" in the trie. Even if the fuzzy domain "abcd" does not exist in the trie, a match can still be achieved through the mismatch nodes. Figure 4C In the trie shown, the mismatch node of node b under node a is node b under the root node. The reason is that node b under the root node is the longest suffix of ab. When the target domain name matches ab, it will necessarily match the longest suffix of ab (node ​​b under the root node).

[0105] In one example, after obtaining Figure 4A After the trie shown, the root node's mismatch pointer is set to NULL, indicating that the root node has no mismatched nodes. The child nodes of the root node, i.e., the first-level nodes a and b, are then added to the BFS (Breadth First Search) linked list queue. The first-level node a is read from the BFS linked list queue (it needs to be removed from the BFS linked list queue). The mismatched node of the first-level node a is determined, and its mismatch pointer is set to the address of this mismatched node. The method for determining the mismatched node is explained in subsequent steps. The child nodes of the first-level node a, i.e., the second-level nodes b and c, are then added to the BFS linked list queue (added to the tail of the BFS linked list queue). Read the first-level node b from the BFS linked list queue, determine the mismatch node of the first-level node b, and assign the address of the mismatch node to the matching failure pointer of the first-level node b. Traverse the lower-level nodes of the first-level node b, namely the second-level nodes c and e, and add the second-level nodes c and e to the BFS linked list queue. Continue in this manner until the BFS linked list queue is empty, and obtain the mismatch node of each node in the trie.

[0106] In one example, for each node in the trie, the following steps can be used to determine the mismatched node. Of course, the following method is just an example for determining mismatched nodes and is not a limitation.

[0107] Step S11: Determine the parent node of this node, that is, the node above this node.

[0108] For example, see Figure 4D The image shown is a schematic diagram of a trie. Figure 4D The diagram shows the parent node of each node. For each node, Figure 4D The blue arrow in the image points to the parent node of that node.

[0109] Step S12: Determine whether the parent node of the node is the root node.

[0110] If yes, then step S13 can be executed; otherwise, step S14 can be executed.

[0111] Step S13: If the parent node of this node is the root node, determine the root node as the mismatch node of this node.

[0112] For example, regarding node 'a', since its parent node is the root node, the root node is considered the mismatch node for node 'a'; that is, the failure pointer for node 'a' points to the root node. See, for example... Figure 4E The diagram shows a trie, where the failure pointer (red arrow) of node a points to the root node.

[0113] Similarly, for node b at the first level, since the parent node of node b is the root node, the root node can be used as the mismatch node of node b, that is, the matching failure pointer of node b can point to the root node.

[0114] Step S14: If the parent node of the current node is not the root node, then determine the mismatched node of the parent node of the current node as the current node, and determine whether the target node exists in the lower-level nodes of the current node.

[0115] If yes, then step S15 can be executed; if no, then step S16 can be executed.

[0116] In one example, when a target node exists in the child nodes of the current node, the character index of the target node can be the same as the character index of the current node; that is, the node with the same character index is used as the target node.

[0117] Step S15: Identify the target node as the mismatched node of this node.

[0118] Step S16: Determine if the current node is the root node. If the current node is the root node, then identify the root node as the mismatched node of this node. If the current node is not the root node, then update the mismatched node of the current node to the current node, return to step S14, and repeat the operation of determining whether the target node exists in the subordinate nodes of the current node until the mismatched node of the target node is obtained.

[0119] For node b in the second level, since its parent node is not the root node, the mismatched node (i.e., the root node) of node b's parent node (i.e., node a in the first level) is determined as the current node. Since the current node has a target node among its lower-level nodes, node b in the first level is taken as the target node. Based on this, node b in the first level can be determined as the mismatched node of node b in the second level. For example, see... Figure 4F The diagram shows a trie, where the failed match pointer (red arrow) of the second-level node b points to the first-level node b.

[0120] For node c in the second level, whose parent node is not the root node, the mismatch node (i.e., the root node) of the parent node of node c (i.e., node a in the first level) is determined as the current node. Since there is no target node among the lower-level nodes of the current node, it is determined whether the current node is the root node. Since it is the root node, the root node is determined as the mismatch node of node c in the second level, and the matching failure pointer of node c in the second level points to the root node.

[0121] For nodes c and e under node b in the first level, the processing method is the same as that for node c under node a in the first level. The mismatched nodes are all root nodes.

[0122] For a third-level node d under a second-level node b, since its parent node is not the root node, the mismatched node of the parent node of d (i.e., the second-level node b) (i.e., the first-level node b) is determined as the current node. Since the current node's child nodes do not have a target node (i.e., node d), the process continues to determine if the current node is the root node. Since the current node is not the root node, the mismatched node of the current node (i.e., the first-level node b) (i.e., the root node) is updated to the current node, and the process continues to determine if the current node's child nodes have a target node (i.e., node d). Since the current node's child nodes do not have a target node, the process continues to determine if the current node is the root node. Since the current node is the root node, the root node is determined as the mismatched node of the third-level node d, and the matching failure pointer of the third-level node d points to the root node.

[0123] In one example, after obtaining the mismatch nodes for each node in the trie, i.e., obtaining the failed match pointers for each node, pruning optimization can be performed on these failed match pointers. For example, see... Figure 4G The diagram shows a trie. The mismatched node of node b at level two is node b at level one. The child node of node b at level two is node d, and the child node of node b at level one is also node d; that is, the child nodes are identical. In this case, if node b at level two is mismatched, then node b at level one will also be mismatched. Therefore, it is meaningless to use node b at level one as the mismatched node of node b at level two.

[0124] Based on the above principles, the mismatched nodes of node b in the second level can also be optimized, and the mismatched nodes of node b in the second level can be re-determined. The optimization process of this mismatched node is explained below.

[0125] In one example, the following steps can be used to optimize a mismatched node:

[0126] Step S21: If there is a node to be optimized among all nodes in the trie, then select the node to be optimized from all nodes. The lower-level node of the node to be optimized is the same as the lower-level node of the mismatched node of the node to be optimized.

[0127] For example, we can start from the last level node of the trie and traverse each node in the trie sequentially. For the currently traversed node, if the node has no child nodes, or if the node's mismatched node has no child nodes, then the node is not considered as a node to be optimized, and we continue traversing to the next node.

[0128] If a node has child nodes, and its mismatched node also has child nodes, then we determine whether the child nodes of this node are the same as the child nodes of its mismatched node. Here, "same child nodes" means completely identical, not partially identical. For example, if the child nodes of this node are nodes a and b, and the child nodes of its mismatched node are also nodes a and b, then the child nodes are considered the same, and this node can be added to the node queue as a node to be optimized. Alternatively, if the child nodes of this node are nodes a and b, and the child nodes of its mismatched node are nodes a and c, then the child nodes are considered different, and this node is not considered a node to be optimized.

[0129] In summary, after traversing all nodes of the trie, if any nodes need optimization, they can be added to the node queue in traversal order. In subsequent steps, each node in the queue is traversed sequentially, and its mismatched nodes are optimized. If no nodes need optimization, the optimization process for mismatched nodes can be terminated.

[0130] Step S22: For each node to be optimized, determine the mismatched node of the mismatched node of the node to be optimized as the current node, and determine whether there is a target node in the lower-level nodes of the current node.

[0131] If yes, then step S23 can be executed; if no, then step S24 can be executed.

[0132] In one example, when a target node exists as a child node of the current node, the character index of the target node is the same as the character index of the node to be optimized; that is, the node with the same character index is used as the target node.

[0133] Step S23: Update the target node to the mismatched node of the node to be optimized.

[0134] Step S24: Determine if the current node is the root node. If the current node is the root node, update the root node to the mismatched node of the node to be optimized. If the current node is not the root node, update the mismatched node of the current node to the current node, return to step S22, and re-execute the operation of determining whether the target node exists in the lower-level nodes of the current node, until the mismatched node of the node to be optimized is obtained.

[0135] In one example, steps S22-S24 are similar to steps S14-S16, and will not be repeated here. For example, see... Figure 4G As shown, node b in the second level is the node to be optimized. The mismatched node of the node to be optimized (i.e., the mismatched node of node b in the first level) (i.e., the root node) is determined as the current node, and it is determined whether there is a target node among the lower-level nodes of the current node. If there is no target node, it is determined whether the current node is the root node. If the current node is the root node, the root node is updated to the mismatched node of node b in the second level, that is, the matching failure pointer of node b in the second level points to the root node.

[0136] In one example, the matching process between a target domain name and a trie, based on the trie's corresponding child node arrays and pointers to mismatched nodes, can include: if the first K3 characters of the target domain name are found to have the same character indices as the K3 nodes of the trie, then the target domain name is considered to have matched successfully; otherwise, the match is considered to have failed. The K3 nodes can include one node from each level from the first to the last level; or, the K3 nodes can include one node from each level from the first to the Mth level, and one node from the level below the mismatched node of the Mth level matching node (i.e., the Mth level hit node) to the last level, where Mth level is not the last level.

[0137] For example, with Figure 4C Taking the trie shown as an example, if the target domain name is abd.com, then the first K3 characters of the target domain name are abd. The K3 nodes include one node from the first level to the last level, namely node a of the first level, node b of the second level, and node d of the third level, which means the match is successful.

[0138] If the target domain name is abcd.com, then the first K3 characters of the target domain name are "abcd". The K3 nodes include one node from level 1 to level M, one node from the level below the mismatch node of the matching node in level M to the last level. For example, if level M is level 2, and the matching node in level M is node b in level 2, then the K3 nodes include node a in level 1, node b in level 2, node c (the level below the mismatch node of node b in level 2, i.e., node b in level 1), node d (the level below node c in level 2), and node d (the last level node).

[0139] Fourth, a domain name matching method based on the first prefix tree, second prefix tree, and trie. This method can obtain the target domain name. If the target domain name matches any one of the first prefix tree, second prefix tree, and trie, the matching result is considered successful, and the corresponding processing is performed based on the target domain name. If the target domain name fails to match any of the first prefix tree, second prefix tree, and trie, the matching result is considered unsuccessful, and the corresponding processing is performed based on the target domain name.

[0140] For example, first determine whether the target domain name matches the first prefix tree (see the above embodiment for the matching process). If yes, the target domain name is considered a successful match. If no, determine whether the target domain name matches the second prefix tree. If yes, the target domain name is considered a successful match. If no, determine whether the target domain name matches the trie. If yes, the target domain name is considered a successful match. If no, the target domain name is considered a failed match.

[0141] For example, first determine if the target domain name matches the second prefix tree. If yes, the target domain name is considered a successful match. If no, determine if the target domain name matches the first prefix tree. If yes, the target domain name is considered a successful match. If no, determine if the target domain name matches the trie. If yes, the target domain name is considered a successful match. If no, the target domain name is considered a failed match.

[0142] In summary, we can first determine whether the target domain name matches the first or second prefix tree. Only when the target domain name fails to match both the first and second prefix trees should we determine whether the target domain name matches the trie. The trie, which has a more complex matching process, is placed later. In this way, when the target domain name matches the first or second prefix tree, the matching process can be completed quickly.

[0143] Application Scenario 1: DNS Snooping Function. When DNS Snooping is enabled on network devices (i.e., gateway devices), domain name matching can be performed based on the first prefix tree, second prefix tree, and trie. See [link to relevant documentation]. Figure 5A The diagram shown illustrates domain name matching, which may include:

[0144] Step S31: The DNS client sends a domain name request message to the DNS server.

[0145] For example, the domain name request message carries the target domain name www.abc.com, and the domain name request message is used to request the IP address of the application server corresponding to the target domain name www.abc.com.

[0146] Step S32: The network device forwards the domain name request message to the DNS server.

[0147] After receiving the domain name request message, the network device can also resolve the target domain name www.abc.com from the domain name request message and record the target domain name www.abc.com in the log for subsequent querying.

[0148] Step S33: The DNS server sends a domain name response message to the DNS client. The network device receives the domain name response message, which includes the target domain name and the IP address corresponding to the target domain name.

[0149] The DNS server can resolve the target domain name www.abc.com from the domain name request message and look up the IP address 1.2.3.4 corresponding to the target domain name www.abc.com. This IP address 1.2.3.4 is the IP address of the application server corresponding to the target domain name www.abc.com, which is used to provide services to the target domain name.

[0150] Step S34: The network device obtains the target domain name from the domain name response message and performs domain name matching on the target domain name to obtain the matching result. The matching result of the target domain name may be a successful match or a failed match.

[0151] In one example, a network device can match a target domain name against an exact domain name. If the target domain name matches any exact domain name, the match result is successful. If the target domain name fails to match any exact domain name, it is then matched against a first prefix tree. If the target domain name matches the first prefix tree, the match result is successful. If the target domain name fails to match the first prefix tree, it is then matched against a second prefix tree. If the target domain name matches the second prefix tree, the match result is successful. If the target domain name fails to match the second prefix tree, it is then matched against a trie. If the target domain name matches the trie, the match result is successful. If the target domain name fails to match the trie, the match result is unsuccessful.

[0152] Step S35: If the target domain name is successfully matched, the network device obtains the IP address corresponding to the target domain name from the domain name response message and records the IP address in the forwarding table. If the target domain name is unsuccessfully matched, the network device prohibits recording the IP address corresponding to the target domain name in the forwarding table.

[0153] Step S36: The network device forwards the domain name response message to the DNS client.

[0154] After receiving a response message for a given domain name, the DNS client can resolve the IP address corresponding to the target domain name from the response message. When the DNS client sends an access message to the application server corresponding to the target domain name, the destination IP address of the access message is the IP address corresponding to the target domain name.

[0155] When a network device receives an access message, if its forwarding table includes the destination IP address of the access message, the network device can forward the access message to the application server corresponding to the destination IP address; if the forwarding table does not include the destination IP address of the access message, the network device can intercept the access message.

[0156] Application Scenario 2: DNS Redirection. When DNS redirection is enabled on a network device, domain name matching can be performed based on the first prefix tree, second prefix tree, and trie. DNS redirection is used in scenarios requiring the routing of domain name request packets. The network device listens for passing domain name request packets (UDP packets are supported), parses out information such as the source IP address, source port number, and target domain name from the request packet, performs domain name matching based on the target domain name, and redirects the request packet to the specified DNS server. See also... Figure 5B The diagram shown illustrates domain name matching, which may include:

[0157] Step S41: The DNS client sends a domain name request message to DNS server 1. For example, the destination IP address of the domain name request message can be the IP address of DNS server 1.

[0158] For example, the domain name request message carries the target domain name www.abc.com, and the domain name request message is used to request the IP address of the application server corresponding to the target domain name www.abc.com.

[0159] Step S32: After receiving the domain name request message, if the network device has enabled DNS redirection, the network device obtains the target domain name from the domain name request message and performs domain name matching on the target domain name to obtain the matching result. The matching result of the target domain name may be a successful match or a failed match.

[0160] In one example, a network device can match a target domain name against an exact domain name. If the target domain name matches any exact domain name, the match result is successful. If the target domain name fails to match any exact domain name, it is then matched against a first prefix tree. If the target domain name matches the first prefix tree, the match result is successful. If the target domain name fails to match the first prefix tree, it is then matched against a second prefix tree. If the target domain name matches the second prefix tree, the match result is successful. If the target domain name fails to match the second prefix tree, it is then matched against a trie. If the target domain name matches the trie, the match result is successful. If the target domain name fails to match the trie, the match result is unsuccessful.

[0161] Step S33: If the target domain name matching result is successful, the network device modifies the destination IP address of the domain name request message to obtain a modified domain name request message. The original destination IP address is the IP address of DNS server 1 (the first domain name server), and the modified destination IP address is the IP address of DNS server 2 (the second domain name server). Based on the modified destination IP address, the network device sends the domain name request message to DNS server 2. Alternatively, if the target domain name matching result is unsuccessful, the network device sends the domain name request message to DNS server 1 based on the destination IP address of the domain name request message.

[0162] For example, if the target domain name is successfully matched, the network device selects the first routable domain name server from the group of domain name servers corresponding to the target domain name, such as DNS server 2, and then replaces the destination IP address in the domain name request message with the IP address of the domain name server, and forwards the modified domain name request message to the domain name server corresponding to the destination IP address, i.e., DNS server 2.

[0163] Step S34: If DNS server 1 receives a domain name request message, then DNS server 1 sends a domain name response message to the DNS client. The network device receives the domain name response message and forwards the domain name response message to the DNS client. The domain name response message includes the target domain name and the IP address corresponding to the target domain name.

[0164] For example, DNS server 1 can obtain the target domain name from the domain name request message and determine the IP address of the application server corresponding to the target domain name, and the domain name response message includes the IP address.

[0165] Alternatively, if DNS server 2 receives a domain name request message, then DNS server 2 sends a domain name response message to the DNS client. The network device receives the domain name response message and forwards it to the DNS client. The domain name response message includes the target domain name and the IP address corresponding to the target domain name.

[0166] After receiving a response message for a given domain name, the DNS client can resolve the IP address corresponding to the target domain name from the response message. When the DNS client sends an access message to the application server corresponding to the target domain name, the destination IP address of the access message is the IP address corresponding to the target domain name.

[0167] For example, DNS server 1 can obtain the target domain name from the domain name request message and determine the IP address of the application server corresponding to the target domain name, and the domain name response message includes the IP address.

[0168] As can be seen from the above technical solutions, in this embodiment, a first prefix tree is generated based on the first type of fuzzy domain name, a second prefix tree is generated based on the second type of fuzzy domain name, and a trie is generated based on the third type of fuzzy domain name. The target domain name can be matched using the first prefix tree, the second prefix tree, and the trie, thereby improving the matching efficiency of the target domain name. It can quickly match a large number of fuzzy domain names, improving matching performance, reducing matching time, and meeting practical needs. In scenarios with a large number of fuzzy domain names, it can improve the matching speed of fuzzy domain names, achieving a rapid response to the target domain name, and significantly improving matching performance.

[0169] Regarding matching efficiency analysis, assuming there are N fuzzy domain names, the maximum length of a fuzzy domain name is L1 (maximum 255), and the length of the target domain name is L2 (maximum 255), the average matching efficiency of the linked list is N*L1*L2, and the average matching efficiency of the trie / prefix tree is L1+L2. The improvement in matching performance depends on the number of fuzzy domain names configured; theoretically, 1000 fuzzy domain names can improve matching performance by approximately 1000 times.

[0170] For memory usage analysis, assume there are N fuzzy domain names, the longest fuzzy domain name is L1 (maximum 255), the target domain name is L2 (maximum 255), the number of linked list nodes is N, and the number of nodes in the trie / prefix tree is N*L1. Memory consumption depends on the configuration length of the fuzzy domain names; the shorter the fuzzy domain name configuration, the lower the memory consumption, and the longer the fuzzy domain name configuration, the higher the memory consumption.

[0171] Based on the same application concept as the above method, this application proposes a domain name matching device, see [link to relevant documentation]. Figure 6 The diagram shown is a structural schematic of the domain name matching device, which may include:

[0172] The acquisition module 61 is used to acquire multiple fuzzy domain names, each fuzzy domain name including fuzzy characters and subdomains; the multiple fuzzy domain names include a first type of fuzzy domain name, a second type of fuzzy domain name, and a third type of fuzzy domain name; the fuzzy characters in the first type of fuzzy domain name are located after the subdomain, the fuzzy characters in the second type of fuzzy domain name are located before the subdomain, and the fuzzy characters in the third type of fuzzy domain name are located both before and after the subdomain;

[0173] Generation module 62 is used to generate a first prefix tree based on the subdomains in the first type of fuzzy domain name, wherein the first prefix tree includes multi-level nodes;

[0174] A fourth type of fuzzy domain name is obtained by performing a character reversal operation on the second type of fuzzy domain name; a second prefix tree is generated based on the subdomains in the fourth type of fuzzy domain name, and the second prefix tree includes multi-level nodes;

[0175] A trie is generated based on the subdomains in the third type of fuzzy domain name, and the trie includes multi-level nodes;

[0176] For each node in the first prefix tree, the second prefix tree, and the trie, if the node is not the last-level node, then the node corresponds to a child node array, the child node array includes the information of the node's subordinate nodes, and the information of the subordinate nodes includes the character index and pointer of the subordinate nodes;

[0177] For each node in the trie, there is a pointer to a mismatched node;

[0178] The detection module 63 is used to match the acquired target domain name based on the first prefix tree, the second prefix tree and the trie, and to perform processing corresponding to the matching result based on the target domain name.

[0179] In one example, the character index of a lower-level node in the child node array is obtained by querying a configured compressed table using the character of the lower-level node;

[0180] The compression table includes a mapping relationship between characters and character indices; for uppercase and lowercase characters of the same character, they correspond to the same character index in the compression table.

[0181] In one example, for each node in the trie, the generation module 62 determines the mismatch node of that node by: if the parent node of the node is the root node, then determining the root node as the mismatch node of the node; if the parent node of the node is not the root node, then determining the mismatch node of the parent node as the current node; determining whether there is a target node among the subordinate nodes of the current node, wherein the character index of the target node is the same as the character index of the current node; if yes, then determining the target node as the mismatch node of the node; if no, determining whether the current node is the root node; if the current node is the root node, then determining the root node as the mismatch node of the node; if the current node is not the root node, then updating the mismatch node of the current node to the current node, and repeating the operation of determining whether there is a target node among the subordinate nodes of the current node until the mismatch node of the node is obtained.

[0182] In one example, after the generation module 62 determines the mismatched node of each node in the trie, the generation module 62 is further configured to: if there is a node to be optimized among all nodes in the trie, select the node to be optimized, wherein the lower-level node of the node to be optimized is the same as the lower-level node of the mismatched node of the node to be optimized; for each node to be optimized, determine the mismatched node of the mismatched node of the node to be optimized as the current node, and determine whether there is a target node in the lower-level node of the current node;

[0183] If so, then update the target node to the mismatched node of the node to be optimized;

[0184] If not, determine whether the current node is the root node; if the current node is the root node, update the root node to the mismatched node of the node to be optimized; if the current node is not the root node, update the mismatched node of the current node to the current node, and repeat the operation of determining whether the target node exists in the lower-level nodes of the current node until the mismatched node of the node to be optimized is obtained.

[0185] In one example, the detection module 63 matches the acquired target domain name based on the first prefix tree, the second prefix tree, and the trie. When performing the processing corresponding to the matching result based on the target domain name, it is specifically used to: obtain the target domain name;

[0186] If the target domain name matches any one of the first prefix tree, the second prefix tree, and the trie, then the matching result of the target domain name is determined to be a successful match, and the corresponding processing is performed based on the target domain name.

[0187] Alternatively, if the target domain name fails to match the first prefix tree, the second prefix tree, and the trie, then the matching result of the target domain name is determined to be a match failure, and the corresponding processing is performed based on the target domain name;

[0188] Specifically, when the detection module 63 matches the target domain name with the first prefix tree, it is used to: if, based on the child node array corresponding to each node in the first prefix tree, it is determined that the first K1 characters of the target domain name are the same as the character indices of the K1 nodes of the first prefix tree, then it is determined that the target domain name matches the first prefix tree successfully; otherwise, it is determined that the target domain name does not match the first prefix tree successfully; wherein, the K1 nodes include one node at each level from the first level to the last level;

[0189] Specifically, when the detection module 63 matches the target domain name with the second prefix tree, it performs the following steps: It performs a character reversal operation on the target domain name to obtain the reverse domain name corresponding to the target domain name; if, based on the child node array corresponding to each node in the second prefix tree, it is determined that the first K2 characters of the reverse domain name are the same as the character indices of the K2 nodes in the second prefix tree, then it is determined that the target domain name matches the second prefix tree successfully; otherwise, it is determined that the target domain name does not match the second prefix tree successfully; wherein, the K2 nodes include one node at each level from the first level to the last level.

[0190] Specifically, when the detection module 63 matches the target domain name with the trie, it is used to: if, based on the child node arrays corresponding to each node in the trie and the pointers to the mismatched nodes, it is determined that the first K3 characters of the target domain name are the same as the character indices of the K3 nodes in the trie, then the target domain name is determined to be a successful match with the trie; otherwise, the target domain name is determined to be a failed match with the trie. The K3 nodes include one node at each level from the first level to the last level; or, the K3 nodes include one node at each level from the first level to the Mth level, and one node at each level from the next level of the mismatched node of the Mth level to the last level, where the Mth level is not the last level.

[0191] In one example, when the detection module 63 performs processing corresponding to a successful match based on the target domain name, or performs processing corresponding to a failed match based on the target domain name, it is specifically used for:

[0192] If the target domain name is successfully matched, the IP address of the application server corresponding to the target domain name is obtained and recorded in the forwarding table; if the target domain name is unsuccessfully matched, the recording of the IP address corresponding to the target domain name in the forwarding table is prohibited.

[0193] Upon receiving an access message, if the forwarding table includes the destination IP address of the access message, the access message is forwarded to the application server corresponding to the destination IP address; if the forwarding table does not include the destination IP address of the access message, the access message is intercepted.

[0194] Alternatively, if the target domain name in the domain name request message matches successfully, the destination IP address of the domain name request message is modified. The destination IP address before modification is the IP address of the first domain name server, and the destination IP address after modification is the IP address of the second domain name server. Based on the modified destination IP address, the domain name request message is sent to the second domain name server, and the second domain name server determines the IP address of the application server corresponding to the target domain name.

[0195] If the matching result of the target domain name in the domain name request message is a failure, the domain name request message is sent to the first domain name server based on the destination IP address of the domain name request message, and the first domain name server determines the IP address of the application server corresponding to the target domain name.

[0196] Based on the same application concept as the above method, this application proposes a network device, see [link to application]. Figure 7 As shown, the network device includes a processor 71 and a machine-readable storage medium 72, wherein the machine-readable storage medium 72 stores machine-executable instructions that can be executed by the processor 71; the processor 71 is used to execute the machine-executable instructions to implement the domain name matching method disclosed in the above example of this application.

[0197] Based on the same concept as the above method, this application also provides a machine-readable storage medium storing a plurality of computer instructions, which, when executed by a processor, can implement the domain name matching method disclosed in the above examples of this application.

[0198] The aforementioned machine-readable storage medium can be any electronic, magnetic, optical, or other physical storage device that can contain or store information, such as executable instructions, data, etc. For example, machine-readable storage media can be: RAM (Random Access Memory), volatile memory, non-volatile memory, flash memory, storage drives (such as hard disk drives), solid-state drives, any type of storage disk (such as optical discs, DVDs, etc.), or similar storage media, or combinations thereof.

[0199] Based on the same concept as the methods described above, this application also provides a computer program product, which may include a computer program. When executed by a processor, the computer program is able to implement the domain name matching method disclosed in the examples above.

[0200] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, embodiments of this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0201] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A domain name matching method, characterized in that, The method includes: Multiple fuzzy domain names are obtained, each fuzzy domain name includes fuzzy characters and subdomains; the multiple fuzzy domain names include a first type of fuzzy domain name, a second type of fuzzy domain name, and a third type of fuzzy domain name; the fuzzy characters in the first type of fuzzy domain name are located after the subdomains, the fuzzy characters in the second type of fuzzy domain name are located before the subdomains, and the fuzzy characters in the third type of fuzzy domain name are located both before and after the subdomains; A first prefix tree is generated based on the subdomains in the first type of fuzzy domain name, and the first prefix tree includes multi-level nodes; A fourth type of fuzzy domain name is obtained by performing a character reversal operation on the second type of fuzzy domain name; a second prefix tree is generated based on the subdomains in the fourth type of fuzzy domain name, and the second prefix tree includes multi-level nodes; A trie is generated based on the subdomains in the third type of fuzzy domain name, and the trie includes multi-level nodes; For each node in the first prefix tree, the second prefix tree, and the trie, if the node is not the last-level node, then the node corresponds to a child node array, the child node array includes the information of the node's subordinate nodes, and the information of the subordinate nodes includes the character index and pointer of the subordinate nodes; For each node in the trie, there is a pointer to a mismatched node; The first prefix tree, the second prefix tree, and the trie are used to match the acquired target domain name and perform processing corresponding to the matching result based on the target domain name. Specifically, after determining the mismatched node of each node in the trie, if there is a node to be optimized among all nodes in the trie, then the node to be optimized is selected, and the lower-level node of the node to be optimized is the same as the lower-level node of the mismatched node of the node to be optimized; for each node to be optimized, the mismatched node of the mismatched node of the node to be optimized is determined as the current node, and it is determined whether there is a target node in the lower-level node of the current node, and the character index of the target node is the same as the character index of the node to be optimized; if so, the target node is updated to be the mismatched node of the node to be optimized; If not, determine whether the current node is the root node; if the current node is the root node, update the root node to the mismatched node of the node to be optimized; if the current node is not the root node, update the mismatched node of the current node to the current node, and repeat the operation of determining whether the target node exists in the lower-level nodes of the current node until the mismatched node of the node to be optimized is obtained.

2. The method according to claim 1, characterized in that, For the character index of the lower-level node in the child node array, the character index is obtained by querying the configured compression table through the character of the lower-level node; wherein, the compression table includes the mapping relationship between characters and character indexes; for uppercase and lowercase characters of the same character, they correspond to the same character index in the compression table.

3. The method according to claim 1, characterized in that, For each node in the trie, the process of determining the mismatched node for that node includes: If the parent node of this node is the root node, then the root node is identified as the mismatch node of this node. If the parent node of this node is not the root node, then the mismatched node of the parent node is determined as the current node. Determine whether a target node exists in the lower-level nodes of the current node, and whether the character index of the target node is the same as that of the current node; if so, then determine the target node as the mismatch node of the current node. If not, determine whether the current node is the root node; if the current node is the root node, determine the root node as the mismatch node of the current node; if the current node is not the root node, update the mismatch node of the current node to the current node, and repeat the operation of determining whether the target node exists in the subordinate nodes of the current node until the mismatch node of the node is obtained.

4. The method according to any one of claims 1-3, characterized in that, The method further includes: Obtain the target domain name; If the target domain name matches any one of the first prefix tree, the second prefix tree, and the trie, then the matching result of the target domain name is determined to be a successful match, and the corresponding processing is performed based on the target domain name. Alternatively, if the target domain name fails to match the first prefix tree, the second prefix tree, and the trie, then the matching result of the target domain name is determined to be a match failure, and the corresponding processing is performed based on the target domain name; The matching process between the target domain name and the first prefix tree includes: If, based on the child node array corresponding to each node in the first prefix tree, it is determined that the first K1 characters of the target domain name are the same as the character indices of the K1 nodes in the first prefix tree, then the target domain name is determined to be a successful match with the first prefix tree; otherwise, the target domain name is determined to be a failed match with the first prefix tree. The K1 nodes include one node at each level from the first level to the last level. The matching process between the target domain name and the second prefix tree includes: Perform a character reverse operation on the target domain name to obtain the reverse domain name corresponding to the target domain name; if, based on the child node array corresponding to each node in the second prefix tree, it is determined that the first K2 characters of the reverse domain name are the same as the character indices of the K2 nodes of the second prefix tree, then it is determined that the target domain name matches the second prefix tree successfully; otherwise, it is determined that the target domain name does not match the second prefix tree successfully; wherein, the K2 nodes include one node at each level from the first level to the last level; The matching process between the target domain name and the trie includes: If, based on the child node arrays corresponding to each node in the trie and the pointers to the mismatched nodes, it is determined that the first K3 characters of the target domain name are the same as the character indices of the K3 nodes in the trie, then the target domain name is determined to be a successful match with the trie; otherwise, the target domain name is determined to be a failed match with the trie. The K3 nodes include one node at each level from the first level to the last level; or, the K3 nodes include one node at each level from the first level to the Mth level, and one node at each level from the next level of the mismatched node of the Mth level matching node to the last level, where the Mth level is not the last level.

5. The method according to claim 4, characterized in that, The process corresponding to a successful match is performed based on the target domain name, or the process corresponding to a failed match is performed based on the target domain name, including: If the target domain name is successfully matched, the IP address of the application server corresponding to the target domain name is obtained and recorded in the forwarding table; if the target domain name is unsuccessfully matched, the recording of the IP address corresponding to the target domain name in the forwarding table is prohibited. Upon receiving an access message, if the forwarding table includes the destination IP address of the access message, the access message is forwarded to the application server corresponding to the destination IP address; if the forwarding table does not include the destination IP address of the access message, the access message is intercepted. Alternatively, if the target domain name in the domain name request message matches successfully, the destination IP address of the domain name request message is modified. The destination IP address before modification is the IP address of the first domain name server, and the destination IP address after modification is the IP address of the second domain name server. Based on the modified destination IP address, the domain name request message is sent to the second domain name server, and the second domain name server determines the IP address of the application server corresponding to the target domain name. If the matching result of the target domain name in the domain name request message is a failure, the domain name request message is sent to the first domain name server based on the destination IP address of the domain name request message, and the first domain name server determines the IP address of the application server corresponding to the target domain name.

6. A domain name matching device, characterized in that, The device includes: The acquisition module is used to acquire multiple fuzzy domain names, each fuzzy domain name including fuzzy characters and subdomains; the multiple fuzzy domain names include a first type of fuzzy domain name, a second type of fuzzy domain name, and a third type of fuzzy domain name; the fuzzy characters in the first type of fuzzy domain name are located after the subdomain, the fuzzy characters in the second type of fuzzy domain name are located before the subdomain, and the fuzzy characters in the third type of fuzzy domain name are located both before and after the subdomain; The generation module is used to generate a first prefix tree based on the subdomains in the first type of fuzzy domain name, wherein the first prefix tree includes multi-level nodes; A fourth type of fuzzy domain name is obtained by performing a character reversal operation on the second type of fuzzy domain name; a second prefix tree is generated based on the subdomains in the fourth type of fuzzy domain name, and the second prefix tree includes multi-level nodes; A trie is generated based on the subdomains in the third type of fuzzy domain name, and the trie includes multi-level nodes; For each node in the first prefix tree, the second prefix tree, and the trie, if the node is not the last-level node, then the node corresponds to a child node array, the child node array includes the information of the node's subordinate nodes, and the information of the subordinate nodes includes the character index and pointer of the subordinate nodes; For each node in the trie, there is a pointer to a mismatched node; The detection module is used to match the acquired target domain name based on the first prefix tree, the second prefix tree, and the trie, and to perform processing corresponding to the matching result based on the target domain name; Wherein, after the generation module determines the mismatch node of each node in the trie, the generation module is further configured to: if there is a node to be optimized among all nodes in the trie, select the node to be optimized, wherein the lower-level node of the node to be optimized is the same as the lower-level node of the mismatch node of the node to be optimized; for each node to be optimized, determine the mismatch node of the mismatch node of the node to be optimized as the current node, and determine whether there is a target node in the lower-level node of the current node, wherein the character index of the target node is the same as the character index of the node to be optimized; If yes, then update the target node to the mismatched node of the node to be optimized; if no, then determine whether the current node is the root node; if the current node is the root node, then update the root node to the mismatched node of the node to be optimized; if the current node is not the root node, then update the mismatched node of the current node to the current node, and repeat the operation of determining whether the target node exists in the lower-level nodes of the current node until the mismatched node of the node to be optimized is obtained.

7. The apparatus according to claim 6, characterized in that, For the character index of the lower-level node in the child node array, the character index is obtained by querying the configured compression table through the character of the lower-level node; wherein, the compression table includes the mapping relationship between characters and character indexes; for uppercase and lowercase characters of the same character, they correspond to the same character index in the compression table.

8. The apparatus according to claim 6, characterized in that, For each node in the trie, the generation module determines the mismatch node by specifically: If the parent node of this node is the root node, then the root node is identified as the mismatch node of this node. If the parent node of this node is not the root node, then the mismatched node of the parent node is determined as the current node. Determine whether a target node exists in the lower-level nodes of the current node, wherein the character index of the target node is the same as the character index of the current node; If so, then the target node is identified as the mismatched node of that node; If not, determine whether the current node is the root node; if the current node is the root node, determine the root node as the mismatch node of the current node; if the current node is not the root node, update the mismatch node of the current node to the current node, and repeat the operation of determining whether the target node exists in the subordinate nodes of the current node until the mismatch node of the node is obtained.

9. The apparatus according to any one of claims 6-8, characterized in that, The detection module matches the acquired target domain name based on the first prefix tree, the second prefix tree, and the trie. When performing processing corresponding to the matching result based on the target domain name, it specifically performs the following: Obtain the target domain name; If the target domain name matches any one of the first prefix tree, the second prefix tree, and the trie, then the matching result of the target domain name is determined to be a successful match, and the corresponding processing is performed based on the target domain name. Alternatively, if the target domain name fails to match the first prefix tree, the second prefix tree, and the trie, then the matching result of the target domain name is determined to be a match failure, and the corresponding processing is performed based on the target domain name; Specifically, when the detection module matches the target domain name with the first prefix tree, it is used to: if, based on the child node array corresponding to each node in the first prefix tree, it is determined that the first K1 characters of the target domain name are the same as the character indices of the K1 nodes of the first prefix tree, then the target domain name is determined to be a successful match with the first prefix tree; otherwise, the target domain name is determined to be a failed match with the first prefix tree; wherein, the K1 nodes include one node at each level from the first level to the last level; Specifically, when the detection module matches the target domain name with the second prefix tree, it performs the following steps: It performs a character reversal operation on the target domain name to obtain the reverse domain name corresponding to the target domain name; if, based on the child node array corresponding to each node in the second prefix tree, it is determined that the first K2 characters of the reverse domain name are the same as the character indices of the K2 nodes in the second prefix tree, then it is determined that the target domain name matches the second prefix tree successfully; otherwise, it is determined that the target domain name does not match the second prefix tree successfully; wherein, the K2 nodes include one node at each level from the first level to the last level. Specifically, when the detection module matches the target domain name with the trie, it is used to: if, based on the child node arrays corresponding to each node in the trie and the pointers to the mismatched nodes, it is determined that the first K3 characters of the target domain name are the same as the character indices of the K3 nodes in the trie, then the target domain name is determined to be a successful match with the trie; otherwise, the target domain name is determined to be a failed match with the trie. The K3 nodes include one node from each level from the first level to the last level; or, the K3 nodes include one node from each level from the first level to the Mth level, and one node from the level below the mismatched node of the Mth level matching node to the last level, where the Mth level is not the last level.

10. The apparatus according to claim 9, characterized in that, The detection module performs the processing corresponding to a successful match based on the target domain name, or performs the processing corresponding to a failed match based on the target domain name, specifically for: If the target domain name is successfully matched, the IP address of the application server corresponding to the target domain name is obtained and recorded in the forwarding table; if the target domain name is unsuccessfully matched, the recording of the IP address corresponding to the target domain name in the forwarding table is prohibited. Upon receiving an access message, if the forwarding table includes the destination IP address of the access message, the access message is forwarded to the application server corresponding to the destination IP address; if the forwarding table does not include the destination IP address of the access message, the access message is intercepted. Alternatively, if the matching result of the target domain name in the domain name request message is successful, then the destination IP address of the domain name request message is modified. The destination IP address before modification is the IP address of the first domain name server, and the destination IP address after modification is the IP address of the second domain name server. Based on the modified destination IP address, the domain name request message is sent to the second domain name server, which then determines the IP address of the application server corresponding to the target domain name. If the matching result of the target domain name in the domain name request message is a failure, the domain name request message is sent to the first domain name server based on the destination IP address of the domain name request message, and the first domain name server determines the IP address of the application server corresponding to the target domain name.

11. A network device, characterized in that, include: A processor and a machine-readable storage medium, the machine-readable storage medium storing machine-executable instructions that can be executed by the processor; The processor is configured to execute machine-executable instructions to implement the method described in any one of claims 1-5.

Images