Domain name status alarm method and device, electronic equipment and medium

Abstract

The application relates to the technical field of network security, in particular to a domain name state alarm method and device, electronic equipment and medium. The method comprises the following steps: determining domain name state information of a first type of state code in a predetermined time window based on head information of head requests of a plurality of nodes for a target domain name; the domain name state information comprises a proportion of the first type of state code, a response time, an abnormal duration and a maintenance identifier of whether the abnormal duration is a maintenance period; inputting the domain name state information of the first type of state code into an anomaly detection model based on an isolated forest algorithm for identification to obtain an anomaly identification result; and if the anomaly identification result is abnormal, performing alarm processing according to the proportion. The single-node misjudgment problem caused by monitoring and alarm of a single node is solved, the coverage and accuracy of domain name state detection are improved, and since the isolated forest algorithm is introduced, dynamic identification of abnormal modes is realized, and the situation of repeated alarm is avoided.

Description

Technical Field

[0001] This application relates to the field of network security analysis, and in particular to a domain name status alert method, device, electronic device, and medium. Background Technology

[0002] In the core infrastructure of modern internet businesses, domain name service is the primary entry point for users to access websites, API services, and cloud applications. Once a domain name service status code becomes abnormal (such as HTTP 5xx), it will directly lead to business interruption, preventing users from accessing websites or applications (such as failed e-commerce payments or interrupted online education live streams). Therefore, regular monitoring of domain name status and issuing anomaly alerts are crucial.

[0003] Current domain name alerting methods have the following shortcomings: 1. Repetitiveness: Alerts are issued whenever a domain name shows abnormality, leading to continuous alerts even when abnormalities persist, ultimately turning alert information into nuisance. 2. Inaccuracy: Monitoring and alerting based on a single node can result in errors. For example, access from other locations might show a 500 error, while the current node shows a 200 error, in which case an alert should be issued but is not. 3. Inability to identify maintenance time periods: If a domain name is consistently shut down from 22:00 on one day to 06:00 the next day, alerts issued by the system during this period are invalid. Summary of the Invention

[0004] In view of this, one of the technical problems solved by the embodiments of this application is to provide a domain name status alarm method, device, electronic device and medium to solve the problem of single-node misjudgment caused by using a single node for monitoring and alarm.

[0005] According to a first aspect of the embodiments of this application, a domain name status alarm method is provided, the method comprising:

[0006] Based on the header information of the head requests of multiple nodes for the target domain, the domain status information of the first type of status code within the predetermined time window is determined. The domain status information includes the proportion of the first type of status code, response time, abnormal duration, and maintenance identifier of whether the abnormal duration is a maintenance period.

[0007] The domain status information of the first type of status code is input into the anomaly detection model based on the isolated forest algorithm for identification, and the anomaly identification result is obtained.

[0008] If the anomaly identification result is abnormal, an alarm will be triggered based on the percentage.

[0009] A second aspect of this application discloses a domain name status alarm device, the device comprising:

[0010] The domain name information determination module is used to determine the domain name status information of the first type of status code within a predetermined time window based on the header information of the head requests of multiple nodes for the target domain name. The domain name status information includes the proportion of the first type of status code, response time, abnormal duration, and maintenance identifier of whether the abnormal duration is a maintenance period.

[0011] The domain anomaly detection module is used to input the domain status information of the first type of status code into the anomaly detection model based on the isolated forest algorithm for identification, and obtain the anomaly identification result;

[0012] The domain name alarm processing module is used to perform alarm processing based on the proportion if the anomaly identification result is abnormal.

[0013] A third aspect of this application discloses an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described method.

[0014] A fourth aspect of this application discloses a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the above-described method.

[0015] This application embodiment deploys a multi-node cluster to collect data to determine the domain name status information within a predetermined time window. It uses an anomaly detection model based on the isolated forest algorithm to obtain anomaly identification results and then performs alarm processing based on the proportion of status codes. This method of evaluating domain name status by collecting data from multiple clusters solves the problem of single-node misjudgment caused by using a single node for monitoring and alarming, and improves the coverage and accuracy of domain name status detection. Due to the introduction of the isolated forest algorithm, dynamic identification of abnormal patterns is achieved, avoiding repeated alarms. Attached Figure Description

[0016] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0017] Figure 1 A flowchart illustrating a domain name status alarm method provided in one embodiment of this application;

[0018] Figure 2 This is a schematic diagram of the domain name status alarm device provided in one embodiment of this application. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0020] It should be noted that although functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart.

[0021] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0022] According to one embodiment of this application, a domain name status alarm method is provided, such as... Figure 1 As shown, the method includes steps S101, S102 and S103.

[0023] Step S101: Based on the header information of the head requests of multiple nodes for the target domain name, determine the domain name status information of the first type of status code within the predetermined time window. The domain name status information includes the proportion of the first type of status code, response time, abnormal duration, and maintenance identifier of whether the abnormal duration is a maintenance period.

[0024] Specifically, the alarm system can issue collection tasks to a multi-node cluster (i.e., multiple nodes), controlling the cluster to send HEAD requests according to the sampling period specified in the collection task. This allows the alarm system to obtain the data collected by the cluster, specifically the header information of the domain name's response to the HEAD requests sent by each node in the cluster. More specifically, the alarm system can specify nodes to monitor a target domain name through collection tasks; for example, multiple nodes within a specified area can monitor the target domain name.

[0025] Specifically, data collected by different nodes can be pre-stored in a preset database. Each record in the database can include information such as timestamp, domain name, node ID, status code, response time, and geographical location. The alarm system filters this database to obtain several records of the monitored target domain name, which represents the header information returned by multiple nodes initiating head requests to the target domain name.

[0026] Specifically, the first category of status codes can include client-side error status codes 4XX (such as 404) and server-side error status codes 5XX, indicating that an error occurred while the server was processing the request. For example, status code 500 indicates that the server encountered an unexpected error. More specifically, the first category of status codes can be pre-specified or dynamically determined based on real-time collected data. For instance, assuming the first category of status codes is server-side error status codes 5XX, during application, the ratio of the number of 5XX status codes to the total number of HTTP status codes is calculated to obtain the proportion of 5XX.

[0027] Step S102: Input the domain name status information of the first type of status code into the anomaly detection model based on the isolated forest algorithm for identification, and obtain the anomaly identification result.

[0028] Specifically, the anomaly identification result output by the anomaly detection model is determined by calculating the anomaly score and comparing it with a threshold. For example, assuming the anomaly score calculated by the anomaly detection model is S, s is compared with the threshold quantile. If S is not less than the threshold quantile, the anomaly identification result is determined to be an anomaly; otherwise, it is considered normal.

[0029] When applying this method, the following formula can be used to calculate the anomaly score:

[0030] Where h(x) is the path length of data point x in the tree, E(h(x)) is the average of h(x) in all trees, and c(n) is the normalization factor related to the number of samples n.

[0031] Step S103: If the anomaly identification result is abnormal, then perform alarm processing according to the proportion.

[0032] Specifically, an alarm is triggered if the percentage is not less than the percentage threshold; otherwise, the alarm is ignored.

[0033] This application embodiment deploys a multi-node cluster to collect data to determine the domain name status information within a predetermined time window. It uses an anomaly detection model based on the isolated forest algorithm to obtain anomaly identification results and then performs alarm processing based on the proportion of status codes. This method of evaluating domain name status by collecting data from multiple clusters solves the problem of single-node misjudgment caused by using a single node for monitoring and alarming, and improves the coverage and accuracy of domain name status detection. Due to the introduction of the isolated forest algorithm, dynamic identification of abnormal patterns is achieved, avoiding repeated alarms.

[0034] In some embodiments, step S101 further includes:

[0035] Step S1011 (not shown in the figure): Statistical analysis is performed on the timestamps included in the header information of the head requests of multiple nodes for the target domain name to obtain the time series of the first type of status code. The time series includes the number of occurrences of the first type of status code corresponding to each sampling time point in the predetermined time window.

[0036] Step S1012 (not shown in the figure): Determine the corresponding duration of the anomaly based on the time series;

[0037] Step S1013 (not shown in the figure): Perform Fourier transform processing on the time series, perform anomaly analysis based on the energy spectrum obtained from the Fourier transform processing to obtain the maintenance period, and determine whether the duration of the anomaly is the maintenance identifier of the maintenance period based on the maintenance period.

[0038] Specifically, the header information of a domain's origin server's response to a head request typically includes: HTTP status codes (including 2xx / 3xx / 4xx / 5xx), request / response time (milliseconds), node geographic location (latitude and longitude or area code), and timestamps (accurate to the second). Therefore, by analyzing the header information, the proportion of the first type of status codes, such as the proportion of 5xx, can be statistically determined. Simultaneously, a time series of 5xx status codes can be generated based on the timestamps, meaning the number of times 5xx status codes appear in head request responses from several nodes to the target domain at the same time point can be statistically analyzed. In application, after filtering out the corresponding records using the first type of status code as the key, the time series within a predetermined time window is statistically analyzed based on the timestamps of these records.

[0039] Specifically, the predetermined time window is typically set to 24 hours, meaning the maintenance time of the target domain is monitored daily. More specifically, the occurrence frequency of 5xx is counted within the predetermined time window according to a predetermined sampling interval (e.g., 1 hour). Specifically, the Fast Fourier Transform (FFT) function in NumPy can be used to convert the time series into an amplitude spectrum in the frequency domain. Since fixed maintenance causes status codes to repeat abnormally within the same time period, forming a strictly periodic signal, and Fourier Transform is highly sensitive to periodic signals, converting the signal from the time domain to the frequency domain through Fourier Transform processing allows for accurate extraction of frequency components. Abnormal data during maintenance periods exhibits significant energy peaks in the frequency domain, clearly distinguishable from non-periodic noise. This allows for the analysis of the periodic patterns during maintenance periods, playing a role in learning periodic patterns by combining historical data and differentiating between normal maintenance and genuine anomalies.

[0040] For example, suppose a domain name records the following number of 5xx errors per hour within a 24-hour period: [5,8,5,8,5,8,5,2,0,2,0,0,0,0,0,0,0,0,0,0,0,2,5,8]. Performing a Fourier transform on this record and outputting the amplitude (energy) of each frequency component yields the following result: [63.45.9870089913.69680767 6.5682673210.14889157 3.9351999 5.38516481 6.60082603 1.73205081 3.85459004 3.79439845 8.83958716 13. 8.83958716 3.79439845 3.85459004 1.73205081 6.60082603

[0043] 5.38516481 3.9351999 10.14889157 6.56826732 13.6968076745.98700899).

[0044] Based on the detected periodic frequency (e.g., 24 hours), combined with the raw data, the specific time period is determined: in this example, 5xx errors are concentrated between 22:00 and 06:00, which is consistent with the period of the spectrum analysis.

[0045] In the above embodiments, the first type of status code is set to the server error status code 5XX. By pre-setting the first type of status code, the type of business alarm is targeted, so as to improve alarm efficiency and maximize system resource utilization.

[0046] In some embodiments, step S1011 further includes: determining the proportion of each of the multiple sub-status codes within a predetermined time window based on the node ID and its status code included in the header information of the head request for the target domain name by each of the multiple nodes; when the proportion of any sub-status code is greater than a preset sub-status code proportion threshold, or a predetermined number of sub-status codes before the proportion is sorted, performing a statistical analysis on the timestamps included in the header information of the head request for the target domain name by each of the multiple nodes to obtain the time series of the first type of status code for that sub-status code or the predetermined number of sub-status codes before the proportion is sorted.

[0047] Specifically, the sub-status code threshold can be set based on the priority of resolving server-side errors. In practice, the sub-status code threshold is generally set to 0.6, meaning that if the proportion of server-side error sub-status codes is greater than 0.6, it indicates a high probability of the target domain experiencing this type of error and necessitates immediate resolution. Similarly, server-side error sub-status codes that occur more frequently are prioritized for resolution, i.e., anomaly detection is performed first.

[0048] In the embodiment where the first type of status code is server error status code 5XX, before step S102, the method further includes: determining the domain name status information of each of the multiple sub-status codes included in the first type of status code; step S102 further includes: inputting the domain name status information of the first type of status code and the domain name status information of each of the multiple sub-status codes included in the first type of status code into an anomaly detection model based on the isolated forest algorithm for identification.

[0049] This application utilizes an anomaly detection model based on the isolated forest algorithm to identify the first type of status code and its sub-status codes. It can achieve both global analysis of server error status code 5XX and analysis of each specific error type included in server error status code 5XX, thereby obtaining anomaly identification details of server error status code 5XX and providing data support for subsequent alarm events.

[0050] In some embodiments, prior to step S102, the method further includes: standardizing the percentage, response time, and anomaly duration to obtain standardized percentage, standardized response time, and standardized anomaly duration. The percentage, response time, and anomaly duration are converted to a distribution with a mean of 0 and a standard deviation of 1, bringing all features to the same scale. For example, a response time of 5000ms might be standardized to 2.5, and the 5xx percentage, after standardization from 20%, becomes -0.3. Standardization enhances the consistency of the anomaly detection model across different datasets, especially in multi-feature collaborative analysis, preventing some features from being over-segmented due to their large numerical range.

[0051] In some embodiments, step S103 further includes: if the anomaly identification result is an anomaly and the proportion of the first type of status code is greater than a preset proportion alarm threshold, then an alarm processing is performed.

[0052] Specifically, the percentage alarm threshold can be set according to business needs.

[0053] Specifically, different percentage alarm thresholds can be set for different monitoring levels. For example, when a user-selected monitoring level is detected, the user-selected monitoring level is looked up in a locally stored alarm threshold lookup table to obtain the corresponding percentage alarm threshold. The percentage of the first type of status code is compared with the queried percentage alarm threshold. If it is greater than the queried percentage alarm threshold, alarm processing is performed; otherwise, no alarm is triggered.

[0054] In some embodiments, prior to step S102, the method further includes:

[0055] The initial isolated forest algorithm is trained using multiple isolated trees based on multiple sample data. The number of isolated trees, sample data, and anomaly parameters are adjusted until a well-trained anomaly detection model is obtained.

[0056] The Isolation Forest algorithm is constructed from multiple isolated trees, and its core principle is to identify distinct states. Assuming the data initially consists entirely of normal states, the algorithm considers all data normal. Then, an anomalous state appears, different from the previous normal states, and the algorithm marks it as anomalous. As anomalous states continue to emerge, their numbers increase, sometimes even surpassing the number of normal states. At this point, the algorithm considers the normal states anomalous, and the anomalous states become normal. Similarly, if the data remains consistently normal or consistently anomalous, the algorithm will consider it normal because the core of the Isolation Forest algorithm is to identify distinct states, not anomalous ones.

[0057] In this embodiment, the initial values ​​for the initial isolated forest algorithm are: 100 isolated trees, 256 samples per tree, and an outlier parameter of 0.1. During the training process using sample data, the number of trees, sample data, and outlier parameter can be adjusted according to different scenarios. For example, in scenarios with frequent false alarms during nighttime maintenance, the algorithm might identify planned downtime as an anomaly. In such cases, the anomaly ratio can be adjusted from 0.1 to 0.03 to reduce the sensitivity of anomaly detection, while the number of trees can be increased from 100 to 300 to strengthen the learning of periodic patterns. Another example is in cases where sudden service crashes fail to trigger timely alerts. If new anomalies are discovered but not detected, the algorithm can be adjusted as follows: the number of samples per tree can be reduced from 256 to 128 to focus on short-term data changes, and the number of trees can be reduced from 100 to 50 to improve model agility. Finally, in cases where persistent anomalies fail to automatically suppress alerts, if service failures continue to trigger alerts for more than 24 hours, the algorithm can be adjusted as follows: the number of samples per tree can be increased from 256 to 1024 to expand the time window for analyzing persistent states, and the anomaly ratio can be adjusted from 0.1 to 0.25 to classify persistent anomalies as "normal states."

[0058] One embodiment of this application provides a domain name status alarm device, such as... Figure 2 As shown, the device 20 includes: a domain name information determination module 201, a domain name anomaly detection module 202, and a domain name alarm processing module 203.

[0059] The domain name information determination module 201 is used to determine the domain name status information of the first type of status code within a predetermined time window based on the header information of the head requests of multiple nodes for the target domain name. The domain name status information includes the proportion of the first type of status code, response time, abnormal duration, and maintenance identifier of whether the abnormal duration is a maintenance period.

[0060] The domain anomaly detection module 202 is used to input the domain status information of the first type of status code into the anomaly detection model based on the isolated forest algorithm for identification, and obtain the anomaly identification result;

[0061] The domain alarm processing module 203 is used to perform alarm processing according to the proportion if the abnormal identification result is abnormal.

[0062] This application embodiment deploys a multi-node cluster to collect data to determine the domain name status information within a predetermined time window. It uses an anomaly detection model based on the isolated forest algorithm to obtain anomaly identification results and then performs alarm processing based on the proportion of status codes. This method of evaluating domain name status by collecting data from multiple clusters solves the problem of single-node misjudgment caused by using a single node for monitoring and alarming, and improves the coverage and accuracy of domain name status detection. Due to the introduction of the isolated forest algorithm, dynamic identification of abnormal patterns is achieved, avoiding repeated alarms.

[0063] Furthermore, the domain name information determination module includes:

[0064] The time series determination submodule is used to perform statistical analysis on the timestamps included in the header information of the head requests for the target domain from multiple nodes to obtain the time series of the first type of status code. The time series includes the number of occurrences of the first type of status code corresponding to each sampling time point in a predetermined time window.

[0065] The abnormal time determination submodule is used to determine the corresponding abnormal duration based on the time series.

[0066] The maintenance period determination submodule is used to perform Fourier transform processing on the time series, extract significant energy peaks from the energy spectrum obtained by Fourier transform processing to obtain the maintenance period, and determine whether the abnormal duration is a maintenance identifier based on the maintenance period.

[0067] Furthermore, the first type of status code is the server-side error status code.

[0068] Furthermore, the time series determination submodule also includes:

[0069] The sub-status code proportion determination unit is used to determine the proportion of each of the multiple sub-status codes within a predetermined time window based on the node ID and its status code included in the header information of the head requests of multiple nodes for the target domain name.

[0070] The time series determination unit is used to perform statistical analysis on the timestamps included in the header information of the head requests for the target domain name by multiple nodes when the proportion of any sub-status code is greater than a preset sub-status code proportion threshold, or when a predetermined number of sub-status codes are sorted by proportion, to obtain the time series of the first type of status code.

[0071] Furthermore, before inputting the domain status information of the first type of status code into the anomaly detection model based on the isolated forest algorithm for identification, the domain anomaly detection module also includes:

[0072] The sub-status code domain name information determination submodule is used to determine the domain name status information of each of the multiple sub-status codes included in the first type of status code;

[0073] The domain anomaly detection module includes:

[0074] The global anomaly detection submodule is used to input the domain status information of the first type of status code and the domain status information of each of the multiple sub-status codes included in the first type of status code into the anomaly detection model based on the isolated forest algorithm for identification.

[0075] Furthermore, before inputting the domain status information of the first type of status code into the anomaly detection model based on the isolated forest algorithm for identification, the domain anomaly detection module also includes:

[0076] The standardization processing submodule is used to standardize the domain name status information of the first type of status code.

[0077] Furthermore, the domain name alarm processing module includes:

[0078] The alarm judgment submodule is used to perform alarm processing if the anomaly identification result is abnormal and the proportion of the first type of status code is greater than the preset proportion alarm threshold.

[0079] The domain name status alarm device in this embodiment can execute the domain name status alarm method shown in the embodiment of this application. The implementation principle is similar and will not be described again here.

[0080] Another embodiment of this application provides an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above-described method.

[0081] Specifically, the processor can be a CPU, a general-purpose processor, a DSP, an ASIC, an FPGA, or other programmable logic device, transistor logic device, hardware component, or any combination thereof. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements computational functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0082] Specifically, the processor connects to the memory via a bus, which may include a path for transmitting information. The bus can be a PCI bus or an EISA bus, etc. The bus can be divided into address bus, data bus, control bus, etc.

[0083] The memory may be ROM or other types of static storage devices that can store static information and instructions, RAM or other types of dynamic storage devices that can store information and instructions, or EEPROM, CD-ROM or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer, but is not limited thereto.

[0084] Optionally, the memory stores the code of a computer program that executes the scheme of this application, and the execution is controlled by a processor. The processor executes the application code stored in the memory to implement the operation of the apparatus provided in the above embodiments.

[0085] Another embodiment of this application provides a computer-readable storage medium storing computer-executable instructions for performing the methods provided in the above embodiments.

[0086] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0087] It will be understood by those skilled in the art that all or some of the steps and systems in the methods disclosed above can be implemented as software, firmware, hardware, and suitable combinations thereof. Some or all of the physical components can be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, which can include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer. Furthermore, as is known to those skilled in the art, communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0088] The above is a detailed description of the preferred embodiments of this application. However, this application is not limited to the above embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of this application. All such equivalent modifications or substitutions are included within the scope defined by the claims of this application.

Claims

1. A domain name status alert method, characterized in that, include: Based on the header information of the head requests of multiple nodes for the target domain name, the domain name status information of the first type of status code within a predetermined time window is determined. The domain name status information includes the proportion of the first type of status code, response time, abnormal duration, and maintenance identifier of whether the abnormal duration is a maintenance period. The domain name status information of the first type of status code is input into an anomaly detection model based on the isolated forest algorithm for identification, and anomaly identification results are obtained; If the anomaly identification result is abnormal, then an alarm process is executed according to the percentage. The determination of domain status information within a predetermined time window based on the header information of the head requests for the target domain from multiple nodes includes: Statistical analysis is performed on the timestamps included in the header information of the head requests for the target domain name based on multiple nodes to obtain the time series of the first type of status code. The time series includes the number of occurrences of the first type of status code corresponding to each sampling time point of the predetermined time window. The duration of the anomaly is determined based on the time series. The time series is subjected to Fourier transform processing. Significant energy peaks are extracted from the energy spectrum obtained by Fourier transform processing to obtain the maintenance period. The abnormal duration is then determined to be a maintenance identifier for the maintenance period based on the maintenance period.

2. The method according to claim 1, characterized in that, The first type of status code is a server-side error status code.

3. The method according to claim 2, characterized in that, The step of statistically analyzing the timestamps included in the header information of the head requests for the target domain from multiple nodes to obtain the time series of the first type of status code also includes: Based on the node ID and status code included in the header information of the head requests of multiple nodes for the target domain name, the proportion of each of the multiple sub-status codes within the predetermined time window is determined. When the proportion of any sub-status code is greater than the preset sub-status code proportion threshold, or when the proportion is ranked before a predetermined number of sub-status codes, the step of performing statistical analysis on the timestamps included in the header information of the head requests for the target domain name based on multiple nodes is performed on the sub-status code or the sub-status codes ranked before the proportion to obtain the time series of the first type of status code.

4. The method according to claim 2, characterized in that, Before the step of inputting the domain name status information of the first type of status code into the anomaly detection model based on the isolated forest algorithm for identification, the method further includes: Determine the domain name status information for each of the multiple sub-status codes included in the first type of status code; The step of inputting the domain name status information of the first type of status code into the anomaly detection model based on the isolated forest algorithm for identification includes: The domain status information of the first type of status code and the domain status information of each of the multiple sub-status codes included in the first type of status code are input into an anomaly detection model based on the isolated forest algorithm for identification.

5. The method according to claim 1, characterized in that, Before the step of inputting the domain name status information of the first type of status code into the anomaly detection model based on the isolated forest algorithm for identification, the method further includes: The domain name status information of the first type of status code is standardized.

6. The method according to claim 1, characterized in that, If the anomaly identification result is abnormal, then alarm processing is performed according to the proportion, including: If the anomaly identification result is abnormal, and the proportion of the first type of status code is greater than the preset proportion alarm threshold, then alarm processing is performed.

7. A domain name status alarm device, characterized in that, include: The domain name information determination module is used to determine the domain name status information of the first type of status code within a predetermined time window based on the header information of the head requests of multiple nodes for the target domain name. The domain name status information includes the proportion of the first type of status code, response time, abnormal duration, and maintenance identifier of whether the abnormal duration is a maintenance period. The domain anomaly detection module is used to input the domain status information of the first type of status code into the anomaly detection model based on the isolated forest algorithm for identification, and obtain the anomaly identification result; The domain name alarm processing module is used to perform alarm processing according to the proportion if the anomaly identification result is abnormal; The domain name information determination module includes: The time series determination submodule is used to perform statistical analysis on the timestamps included in the header information of the head requests for the target domain from multiple nodes to obtain the time series of the first type of status code. The time series includes the number of occurrences of the first type of status code corresponding to each sampling time point in a predetermined time window. The abnormal time determination submodule is used to determine the corresponding abnormal duration based on the time series. The maintenance period determination submodule is used to perform Fourier transform processing on the time series, extract significant energy peaks from the energy spectrum obtained by Fourier transform processing to obtain the maintenance period, and determine whether the abnormal duration is a maintenance identifier based on the maintenance period.

8. An electronic device, characterized in that, The device includes a processor and a memory, the memory storing computer-readable instructions, and the processor being configured to execute the computer-readable instructions, wherein the computer-readable instructions, when executed, perform the method according to any one of claims 1 to 6.

9. A computer-readable storage medium storing computer-executable instructions for performing the method according to any one of claims 1 to 6.

Images