P2P content distribution network node identification method and system based on DNS log

Abstract

The invention discloses a P2P content distribution network node identification method and system based on a DNS log, and belongs to the technical field of network security and flow analysis. The P2P content distribution network node identification method and device solve the problem that P2P content distribution network nodes cannot be accurately identified in the prior art. According to the method, a DNS analysis log is collected from a recursive analyzer of an internet service provider, then key information of DNS query is extracted from the DNS analysis log, domain name access preference features, content provider aggregation features and external service behavior features of nodes are analyzed according to the extracted key information, then abstract features of the nodes are obtained, and the nodes are analyzed according to the abstract features. And finally, inputting the abstract features of the nodes into a P2P content distribution network node identification model corresponding to the network connection duration, and realizing accurate identification of the P2P content distribution network nodes through the identification model. The method can be applied to P2P content distribution network node identification.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security and traffic analysis, and in particular relates to a P2P content distribution network (PCDN) node identification method and system based on DNS logs. Background Art

[0002] With the development of the internet, P2P content distribution network technology has gradually emerged. This technology integrates the content acceleration capabilities of traditional CDNs with the distributed architecture of P2P networks, utilizing user terminals as content distribution nodes to achieve efficient resource sharing and content distribution. Based on this technology, traffic monetization (RPT) services have emerged, allowing users to install PCDN boxes to become PCDN nodes and earn revenue by renting out their home bandwidth.

[0003] However, the widespread deployment of PCDN nodes has created serious network problems. First, PCDN nodes consume significant additional network resources because they not only handle their own normal network requests but also provide content distribution services to other users, consuming significant bandwidth. Second, by leveraging low-cost home broadband traffic for content distribution, PCDN undermines the market competitiveness of ISPs' high-priced enterprise broadband services and disrupts traditional bandwidth usage and pricing systems. Finally, PCDN interferes with the normal operation of shared bandwidth, degrading the network experience for other users and impacting applications with high real-time requirements, such as online gaming and video conferencing.

[0004] While the PCDN ecosystem has garnered considerable research attention, existing research primarily focuses on issues related to PCDN deployment and implementation, such as security vulnerabilities like video fragment corruption and IP leaks. Currently, there is a lack of research on methods for accurately identifying PCDN nodes within a network. This makes it difficult for network operators and administrators to effectively monitor and manage these nodes, hindering their ability to implement targeted measures to maintain network stability and security. Summary of the Invention

[0005] The purpose of the present invention is to solve the problem that the existing technology cannot accurately identify P2P content distribution network nodes, and propose a P2P content distribution network node identification method based on DNS logs.

[0006] The technical solution adopted by the present invention to solve the above technical problems is:

[0007] A method for identifying nodes in a P2P content distribution network based on DNS logs, the method specifically comprising the following steps:

[0008] Step 1: Collect the DNS resolution logs of each DNS query from the recursive resolver of the Internet service provider, and extract information of each DNS query based on the collected DNS resolution logs;

[0009] DNS query information includes timestamp, source IP address, source port, query record, fully qualified domain name, and query type;

[0010] Step 2: Classify the fully qualified domain name of each DNS query, and the classification result is whether the query domain name belongs to a PCDN domain name or a non-PCDN domain name;

[0011] According to the source IP address and source port, get the node to which each DNS resolution log belongs;

[0012] Step 3: For any node a, calculate the absolute number of PCDN domain name queries and the total number of PCDN and non-PCDN domain name queries for node a based on the query domain name classification results. Then, calculate the PCDN domain name query ratio for node a. This calculated PCDN domain name query ratio is used as the domain name access preference feature of node a.

[0013] For any DNS resolution log corresponding to node a, determine whether the node accesses a content provider based on the query record in the current resolution log. After traversing each DNS resolution log corresponding to node a, obtain the number of content providers accessed by node a and the total number of times node a accesses content providers, thus obtaining the content provider aggregation feature of node a.

[0014] Obtain the external service behavior characteristics of node a based on the source IP address and query type;

[0015] The feature vector of node a is composed by using the domain name access preference feature, content provider aggregation feature and external service behavior feature of node a;

[0016] Step 4: Input the feature vectors of each node into the XGBoost recognition model to identify whether each node is a P2P content distribution network node.

[0017] Furthermore, the identification of the fully qualified domain name of each DNS query adopts a BERT model.

[0018] Furthermore, the PCDN domain name query ratio of node a is: the ratio of the absolute number of PCDN domain name queries by node a to the total number of PCDN domain name queries and non-PCDN domain name queries by node a.

[0019] Furthermore, the external service behavior characteristics of node a include whether node a has been queried, the number of times node a receives queries, and the ratio of the number of times node a queries other nodes to the number of times node a receives queries.

[0020] Furthermore, the specific process of step 4 is as follows:

[0021] Step 4.1: Divide the node online time into 24-hour intervals, and record each hour interval as (z, z+1], where z is a positive integer;

[0022] Train an XGBoost recognition model for each hour interval;

[0023] Step 42: For node a, determine the network connection duration of node a based on the timestamps of all DNS resolution logs corresponding to node a, and select the corresponding XGBoost recognition model based on the network connection duration of node a;

[0024] The feature vector of node a is input into the selected XGBoost recognition model, and the XGBoost recognition model is used to identify whether node a is a PCDN node.

[0025] A P2P content distribution network node identification system based on DNS logs, the system comprising a DNS resolution log collection module, a DNS query information extraction module, a fully qualified domain name classification module, a node feature vector extraction module and a P2P content distribution network node identification module, wherein:

[0026] The DNS resolution log collection module is used to collect the DNS resolution log of each DNS query from the recursive resolver of the Internet service provider;

[0027] The DNS query information extraction module is used to extract information from the DNS resolution log of each DNS query, wherein the information includes timestamp, source IP address, source port, query record, fully qualified domain name and query type;

[0028] The fully qualified domain name classification module is used to classify the fully qualified domain name of each DNS query, and the classification result is whether the query domain name belongs to a PCDN domain name or a non-PCDN domain name;

[0029] The node feature vector extraction module is used to extract the feature vector of each node based on the information extracted by the DNS query information extraction module and the classification result of the fully qualified domain name classification module;

[0030] The P2P content distribution network node identification module is used to identify whether a node is a P2P content distribution network node according to a feature vector of the node.

[0031] Furthermore, a BERT model is deployed in the fully qualified domain name classification module, and the BERT model is used to classify the fully qualified domain name of each DNS query.

[0032] Furthermore, the working process of the node feature vector extraction module is as follows:

[0033] Step 1: Determine the node to which each DNS resolution log belongs based on the source IP address and source port.

[0034] Step 2: For any node a, calculate the absolute number of PCDN domain name queries and the total number of PCDN and non-PCDN domain name queries for node a based on the query domain name classification results. Then, calculate the ratio of the absolute number of PCDN domain name queries to the total number of PCDN and non-PCDN domain name queries for node a. This ratio is used as the domain name access preference feature of node a.

[0035] Step 3: Determine whether each query record in the DNS resolution log accesses the domain name of the content provider, and then obtain the number of content providers accessed by node a and the total number of times node a accesses the content providers, that is, obtain the content provider aggregation feature of node a;

[0036] Step 4: Obtain the external service behavior characteristics of node a based on the source IP address and query type;

[0037] Step 5: Use the domain name access preference feature, content provider aggregation feature, and external service behavior feature of node a to form the feature vector of node a.

[0038] Furthermore, the external service behavior characteristics of node a include whether node a has been queried, the number of times node a receives queries, and the ratio of the number of times node a queries other nodes to the number of times node a receives queries.

[0039] Furthermore, the working process of the P2P content distribution network node identification module is as follows:

[0040] Divide the node online time into 24-hour intervals, and record each hour interval as (z,z+1], where z is a positive integer; then train an XGBoost recognition model for each hour interval;

[0041] Determine the network connection duration of node a based on the timestamps of all DNS resolution logs corresponding to node a, and select the corresponding XGBoost recognition model based on the network connection duration of node a;

[0042] The feature vector of node a is input into the selected XGBoost recognition model, and the XGBoost recognition model is used to identify whether node a is a PCDN node.

[0043] The beneficial effects of the present invention are:

[0044] The present invention proposes a P2P content distribution network node identification method based on DNS logs. The method collects DNS resolution logs from recursive resolvers of Internet service providers, extracts key information of DNS queries from the DNS resolution logs, analyzes domain name access preference characteristics, content provider aggregation characteristics, and external service behavior characteristics of the nodes based on the extracted key information, and then obtains abstract characteristics of the nodes. Finally, the abstract characteristics of the nodes are input into a P2P content distribution network node identification model corresponding to the network connection duration. The P2P content distribution network nodes are accurately identified through the identification model. The method of the present invention can improve the accuracy and efficiency of network management performed by network operators and administrators, reduce the negative impact of P2P content distribution network nodes on network stability, and improve the stability and security of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 It is a flow chart of a P2P content distribution network node identification method based on DNS logs of the present invention;

[0046] Figure 2 It is a node relationship diagram when extracting external service behavior features. DETAILED DESCRIPTION

[0047] Specific implementation method 1: Combination Figure 1 This embodiment describes a method for identifying nodes in a P2P content distribution network based on DNS logs, and the method specifically includes the following steps:

[0048] Step 1: Collect the DNS resolution logs of each DNS query from the recursive resolver of the Internet Service Provider (ISP), and extract the key information of each DNS query based on the collected DNS resolution logs;

[0049] Key information of DNS queries includes timestamp, source IP address, source port, query record, fully qualified domain name (FQDN), and query type (QTYPE);

[0050] Step 2: Classify the fully qualified domain name of each DNS query, and the classification result is whether the query domain name belongs to a PCDN domain name or a non-PCDN domain name;

[0051] According to the source IP address and source port, get the node to which each DNS resolution log belongs;

[0052] It should be noted that due to the exhaustion of source IP addresses, operators in real-world environments typically adopt IP address reuse strategies. Therefore, relying solely on IP addresses to distinguish users is insufficient. The present invention utilizes the mapping rules and node-IP mapping provided by the ISP to obtain the dynamic port range (i.e., source port) assigned to each node after the IP address. A unique identifier is created for each node by combining the IP address and its corresponding dynamic port range, and then the DNS resolution log belonging to each node is obtained separately.

[0053] Step 3: For any node a, calculate the absolute number of PCDN domain name queries and the total number of PCDN and non-PCDN domain name queries for node a based on the query domain name classification results. Then, calculate the PCDN domain name query ratio for node a. This calculated PCDN domain name query ratio is used as the domain name access preference feature of node a.

[0054] For any DNS resolution log corresponding to node a, determine whether the node accesses a content provider based on the query record in the current resolution log. After traversing each DNS resolution log corresponding to node a, obtain the number of content providers accessed by node a and the total number of times node a accesses content providers, thus obtaining the content provider aggregation feature of node a.

[0055] Obtain the external service behavior characteristics of node a based on the source IP address and query type;

[0056] The feature vector of node a is composed by using the domain name access preference feature, content provider aggregation feature and external service behavior feature of node a;

[0057] Step 4: Input the feature vectors of each node into the XGBoost recognition model to identify whether each node is a P2P content distribution network node.

[0058] This paper extracts features that can distinguish whether a node is equipped with a PCDN box, including "domain name access preference", "content provider aggregation" and "external service behavior".

[0059] Domain name access preference: A significant difference between PCDN nodes and non-PCDN nodes is the number of times the PCDN domain name is accessed. PCDN domain names are domain names used by PCDN boxes to support content distribution, resource localization, and node communication. To perform tasks such as resource caching or resource scheduling, PCDN nodes typically access more PCDN domain names. Therefore, by analyzing the access pattern of PCDN domain names, the domain name access preference of the node can be evaluated, which helps to effectively identify PCDN nodes. For any node, after we obtain all the DNS log entries belonging to node a, we obtain the number of PCDN domain name queries and the total number of PCDN domain name queries and non-PCDN domain name queries for the node based on the domain name classification results of each DNS log, and then calculate the ratio of the number of PCDN domain name queries to the total number of PCDN domain name queries and non-PCDN domain name queries for the node.

[0060] Content provider aggregation: PCDN nodes and non-PCDN nodes differ in the scope of content providers they access. There are various types of content providers on the Internet. Ordinary users tend to only access a small number of fixed content providers, while PCDN nodes typically access a large number of different content providers due to business needs. In addition, in order to cache resources, the domain name visits generated by PCDN nodes far exceed those of ordinary users. By analyzing the content providers behind the domain names accessed by each node, evaluating the scope of content providers accessed and the number of domain names requested, PCDN nodes can be identified. The ISP provides a content provider domain name database. Based on the content provider domain name database, it is determined whether each query record accesses the content provider's domain name and identifies the corresponding content provider. In this way, the number of content providers accessed by each node and the total number of domain name queries can be calculated.

[0061] External service behavior: Another prominent feature of PCDN nodes is that they often act as service providers, providing services to other nodes, which requires them to be frequently accessed. Figure 2 As shown, each IP represents a node, and each DNS query represents a directed edge, with the source IP address of the DNS query as the starting point and the A record of the DNS query as the end point. Due to business needs, PCDN nodes usually have higher out-degree and in-degree. In contrast, users who have not deployed PCDN boxes usually have higher in-degree than out-degree. By counting the number of times each node is resolved, its service provision frequency is estimated, which helps to identify PCDN nodes. A records and CNAME records in the query type are extracted from the DNS log as features. If the IP address of a node appears in the A record or resolved CNAME record of node a, it is considered that this node has been visited once by node a. Since it is impossible to accurately determine which specific node corresponding to the IP address is visited, the present invention believes that the node corresponding to this IP address has been visited once by node a. For example, for Figure 2 For node 7 in the DNS log corresponding to node 7, the A record and CNAME record of the query type are extracted. If the IP address of node 5 appears in the extracted A record and CNAME record, then node 5 has been visited once by node 7. If there are other nodes under the IP address corresponding to node 5, then the other nodes under this IP address are also considered to have been visited once by node 7. Therefore, it is possible to determine whether a node has been visited (queried), the number of times it has been queried, and the total number of times this node has queried other nodes.

[0062] Finally, three types of features are extracted from all DNS logs of each node: domain name access preference features, content provider aggregation features, and external service behavior features. The final features obtained by fusion are shown in Table 1.

[0063] Table 1

[0064]

[0065] Specific embodiment 2: This embodiment differs from specific embodiment 1 in that the BERT model is used to classify the fully qualified domain name of each DNS query.

[0066] Other steps and parameters are the same as those in the first embodiment.

[0067] The present invention utilizes the rich language representation and excellent feature extraction capabilities of the BERT model and uses a PCDN domain name identification method (PDIM) based on the BERT model to identify PCDN domain names and non-PCDN domain names.

[0068] Specific embodiment three: This embodiment differs from specific embodiments one or two in that the PCDN domain name query ratio of node a is: the ratio of the absolute number of PCDN domain name queries by node a to the total number of PCDN domain name queries and non-PCDN domain name queries by node a.

[0069] Other steps and parameters are the same as those in the first or second embodiment.

[0070] Specific implementation method four: This implementation method differs from any one of specific implementation methods one to three in that the external service behavior characteristics of node a include whether node a has been queried, the number of times node a receives queries, and the ratio of the number of times node a queries other nodes to the number of times node a receives queries.

[0071] The other steps and parameters are the same as those in the first to third embodiments.

[0072] Specific embodiment 5: This embodiment differs from any one of specific embodiments 1 to 4 in that the specific process of step 4 is as follows:

[0073] Step 4: Divide the node online time into 24-hour intervals, and record each hour interval as (z, z+1], where z is a positive integer and the value of z ranges from 0 to 23;

[0074] Train an XGBoost recognition model for each hour interval;

[0075] Step 42: For node a, determine the network connection duration of node a based on the timestamps of all DNS resolution logs corresponding to node a, and select the corresponding XGBoost recognition model based on the network connection duration of node a;

[0076] The feature vector of node a is input into the selected XGBoost recognition model, and the XGBoost recognition model is used to identify whether node a is a PCDN node.

[0077] The other steps and parameters are the same as those in the first to fourth embodiments.

[0078] For node a in the network, the various eigenvalues ​​of node a will gradually increase with the duration of the network connection, but within 1 consecutive hour, the eigenvalue changes are relatively small. Therefore, the present invention divides the network connection duration into hourly intervals from 0 to 24 hours, and trains a recognition model for each hourly interval, that is, 24 independent recognition models are obtained, and then the appropriate model is selected for node recognition based on the user's online time. This strategy enhances the adaptability and accuracy of the model under different network connection durations. The present invention selects the XGBoost model to perform the recognition task, and the feature vector generated by "feature fusion" is input into the XGBoost model corresponding to the user's online time. The XGBoost model finally outputs whether the node is a PCDN node.

[0079] Specific embodiment six: This embodiment describes a P2P content distribution network node identification system based on DNS logs, the system comprising a DNS resolution log collection module, a DNS query information extraction module, a fully qualified domain name classification module, a node feature vector extraction module, and a P2P content distribution network node identification module, wherein:

[0080] The DNS resolution log collection module is used to collect the DNS resolution log of each DNS query from the recursive resolver of the Internet service provider;

[0081] The DNS query information extraction module is used to extract information from the DNS resolution log of each DNS query, wherein the information includes timestamp, source IP address, source port, query record, fully qualified domain name and query type;

[0082] The fully qualified domain name classification module is used to classify the fully qualified domain name of each DNS query, and the classification result is whether the query domain name belongs to a PCDN domain name or a non-PCDN domain name;

[0083] The node feature vector extraction module is used to extract the feature vector of each node based on the information extracted by the DNS query information extraction module and the classification result of the fully qualified domain name classification module;

[0084] The P2P content distribution network node identification module is used to identify whether a node is a P2P content distribution network node according to a feature vector of the node.

[0085] Specific embodiment seven: This embodiment differs from specific embodiment six in that a BERT model is deployed in the fully qualified domain name classification module, and the BERT model is used to classify the fully qualified domain name of each DNS query.

[0086] Other steps and parameters are the same as those in the sixth embodiment.

[0087] Specific embodiment eight: This embodiment differs from specific embodiment six or seven in that the working process of the node feature vector extraction module is as follows:

[0088] Step 1: Determine the node to which each DNS resolution log belongs based on the source IP address and source port.

[0089] Step 2: For any node a, calculate the absolute number of PCDN domain name queries and the total number of PCDN and non-PCDN domain name queries for node a based on the query domain name classification results. Then, calculate the ratio of the absolute number of PCDN domain name queries to the total number of PCDN and non-PCDN domain name queries for node a. This ratio is used as the domain name access preference feature of node a.

[0090] Step 3: Determine whether each query record in the DNS resolution log accesses the domain name of the content provider, and then obtain the number of content providers accessed by node a and the total number of times node a accesses the content providers, that is, obtain the content provider aggregation feature of node a;

[0091] Step 4: Obtain the external service behavior characteristics of node a based on the source IP address and query type;

[0092] Step 5: Use the domain name access preference feature, content provider aggregation feature, and external service behavior feature of node a to form the feature vector of node a.

[0093] Other steps and parameters are the same as those in specific implementation manner six or seven.

[0094] Specific embodiment nine: This embodiment differs from any one of specific embodiments six to eight in that the external service behavior characteristics of node a include whether node a has been queried, the number of times node a receives queries, and the ratio of the number of times node a queries other nodes to the number of times node a receives queries.

[0095] The other steps and parameters are the same as those in any one of the sixth to eighth embodiments.

[0096] Specific embodiment 10: This embodiment differs from any one of specific embodiments 6 to 9 in that the working process of the P2P content distribution network node identification module is as follows:

[0097] Divide the node online time into 24-hour intervals, and record each hour interval as (z,z+1], where z is a positive integer; then train an XGBoost recognition model for each hour interval;

[0098] Determine the network connection duration of node a based on the timestamps of all DNS resolution logs corresponding to node a, and select the corresponding XGBoost recognition model based on the network connection duration of node a;

[0099] The feature vector of node a is input into the selected XGBoost recognition model, and the XGBoost recognition model is used to identify whether node a is a PCDN node.

[0100] The other steps and parameters are the same as those in any one of the sixth to ninth embodiments.

[0101] The above examples are merely illustrative of the calculation model and process of the present invention and are not intended to limit the embodiments of the present invention. Persons skilled in the art will readily appreciate that other variations or modifications based on the above description are possible. This list of embodiments is not exhaustive; however, any obvious variations or modifications derived from the technical solution of the present invention remain within the scope of protection of the present invention.

Claims

1. A P2P content distribution network node identification method based on DNS log, characterized in that: The method specifically comprises the following steps: Step 1: Collect the DNS resolution logs of each DNS query from the recursive resolver of the Internet service provider, and extract information of each DNS query based on the collected DNS resolution logs; DNS query information includes timestamp, source IP address, source port, query record, fully qualified domain name, and query type; Step 2: Classify the fully qualified domain name of each DNS query, and the classification result is whether the query domain name belongs to a PCDN domain name or a non-PCDN domain name; According to the source IP address and source port, get the node to which each DNS resolution log belongs; Step 3: For any node a, calculate the absolute number of PCDN domain name queries and the total number of PCDN and non-PCDN domain name queries for node a based on the query domain name classification results. Then, calculate the PCDN domain name query ratio for node a. This calculated PCDN domain name query ratio is used as the domain name access preference feature of node a. For any DNS resolution log corresponding to node a, determine whether the node accesses a content provider based on the query record in the current resolution log. After traversing each DNS resolution log corresponding to node a, obtain the number of content providers accessed by node a and the total number of times node a accesses content providers, thus obtaining the content provider aggregation feature of node a. Obtain the external service behavior characteristics of node a based on the source IP address and query type; The feature vector of node a is composed by using the domain name access preference feature, content provider aggregation feature and external service behavior feature of node a; Step 4: Input the feature vectors of each node into the XGBoost recognition model to identify whether each node is a P2P content distribution network node.

2. A method for identifying nodes in a P2P content distribution network based on DNS logs according to claim 1, characterized in that: The BERT model is used to classify the fully qualified domain name of each DNS query.

3. The method for identifying nodes in a P2P content distribution network based on DNS logs according to claim 2, wherein: The PCDN domain name query ratio of node a is: the ratio of the absolute number of PCDN domain name queries of node a to the total number of PCDN domain name queries and non-PCDN domain name queries of node a.

4. The method for identifying nodes in a P2P content distribution network based on DNS logs according to claim 3, wherein: The external service behavior characteristics of node a include whether node a has been queried, the number of times node a receives queries, and the ratio of the number of times node a queries other nodes to the number of times node a receives queries.

5. The method for identifying nodes in a P2P content distribution network based on DNS logs according to claim 4, characterized in that: The specific process of step 4 is as follows: Step 4.1: Divide the node online time into 24-hour intervals, and record each hour interval as (z, z+1], where z is a positive integer; Train an XGBoost recognition model for each hour interval; Step 42: For node a, determine the network connection duration of node a based on the timestamps of all DNS resolution logs corresponding to node a, and select the corresponding XGBoost recognition model based on the network connection duration of node a; The feature vector of node a is input into the selected XGBoost recognition model, and the XGBoost recognition model is used to identify whether node a is a PCDN node.

6. A P2P content distribution network node identification system based on DNS logs, characterized in that: The system includes a DNS resolution log collection module, a DNS query information extraction module, a fully qualified domain name classification module, a node feature vector extraction module and a P2P content distribution network node identification module, wherein: The DNS resolution log collection module is used to collect the DNS resolution log of each DNS query from the recursive resolver of the Internet service provider; The DNS query information extraction module is used to extract information from the DNS resolution log of each DNS query, wherein the information includes timestamp, source IP address, source port, query record, fully qualified domain name and query type; The fully qualified domain name classification module is used to classify the fully qualified domain name of each DNS query, and the classification result is whether the query domain name belongs to a PCDN domain name or a non-PCDN domain name; The node feature vector extraction module is used to extract the feature vector of each node based on the information extracted by the DNS query information extraction module and the classification result of the fully qualified domain name classification module; The P2P content distribution network node identification module is used to identify whether a node is a P2P content distribution network node according to a feature vector of the node.

7. A P2P content distribution network node identification system based on DNS logs according to claim 6, characterized in that: The fully qualified domain name classification module is deployed with a BERT model, and the BERT model is used to classify the fully qualified domain name of each DNS query.

8. The P2P content distribution network node identification system based on DNS log according to claim 7, characterized in that: The working process of the node feature vector extraction module is as follows: Step 1: Determine the node to which each DNS resolution log belongs based on the source IP address and source port. Step 2: For any node a, calculate the absolute number of PCDN domain name queries and the total number of PCDN and non-PCDN domain name queries for node a based on the query domain name classification results. Then, calculate the ratio of the absolute number of PCDN domain name queries to the total number of PCDN and non-PCDN domain name queries for node a. This ratio is used as the domain name access preference feature of node a. Step 3: Determine whether each query record in the DNS resolution log accesses the domain name of the content provider, and then obtain the number of content providers accessed by node a and the total number of times node a accesses the content providers, that is, obtain the content provider aggregation feature of node a; Step 4: Obtain the external service behavior characteristics of node a based on the source IP address and query type; Step 5: Use the domain name access preference feature, content provider aggregation feature, and external service behavior feature of node a to form the feature vector of node a.

9. The P2P content distribution network node identification system based on DNS log according to claim 8, characterized in that: The external service behavior characteristics of node a include whether node a has been queried, the number of times node a receives queries, and the ratio of the number of times node a queries other nodes to the number of times node a receives queries.

10. A P2P content distribution network node identification system based on DNS logs according to claim 9, characterized in that: The working process of the P2P content distribution network node identification module is as follows: Divide the node online time into 24-hour intervals, and record each hour interval as (z,z+1], where z is a positive integer; then train an XGBoost recognition model for each hour interval; Determine the network connection duration of node a based on the timestamps of all DNS resolution logs corresponding to node a, and select the corresponding XGBoost recognition model based on the network connection duration of node a; The feature vector of node a is input into the selected XGBoost recognition model, and the XGBoost recognition model is used to identify whether node a is a PCDN node.

Images