Embedded device domain name resolution hijacking detection and tracing method and system

Abstract

The application provides an embedded device domain name resolution hijacking detection and tracing method and system, relates to the technical field of device detection, and comprises the following steps: collecting domain name resolution messages in an embedded device network protocol stack, constructing request side and response side records and pairing, calculating a time delay vector, path consistency fingerprints and resolution result consistency indexes, determining a suspicious transaction when the time delay vector deviates from a confidence interval and entering a tracing stage, reversely constructing a candidate intervention point set along a data forwarding path and verifying, and finally generating an irrepudiable tracing result. The application can effectively detect and trace domain name resolution hijacking behaviors and improve the network security protection capability of embedded devices.

Description

TECHNICAL FIELD

[0001] The present application relates to device detection technology, and in particular to an embedded device domain name resolution hijacking detection and tracing method and system. BACKGROUND

[0002] With the rapid development of Internet of Things technology, embedded devices have been widely used in smart home, industrial control, medical devices and many other fields. These devices achieve data exchange and remote control through network connection, and the Domain Name System (DNS) as a core component of Internet infrastructure provides network resource location services for embedded devices. When embedded devices perform network communication, they need to convert domain names into IP addresses through domain name resolution to establish a connection with the target server. However, due to the limitations of embedded devices in computing power, storage space and security protection mechanisms, the domain name resolution process is vulnerable to various security threats, especially domain name resolution hijacking attacks. Domain name resolution hijacking refers to the act of an attacker tampering with the domain name resolution process or results, directing user access to a specific domain name to a server controlled by the attacker, thereby achieving the theft, tampering or interruption of communication content. Domain name resolution hijacking attacks on embedded devices have become an important threat in the current network security field.

[0003] Most of the existing technologies rely on static rule matching or fixed threshold determination, lacking the ability to adapt to dynamic changes in the network environment. In a complex and variable network environment, especially in the edge network environment where embedded devices are located, network load, latency characteristics and other factors frequently fluctuate, making detection methods based on fixed parameters prone to a large number of false positives or false negatives, making it difficult to accurately identify real hijacking behavior.

[0004] Existing detection methods usually separate detection and tracing, and cannot guarantee the relevance and integrity between the detection results and the tracing evidence. In actual application, when a suspicious event is detected, it is often difficult to obtain enough original data to support subsequent tracing analysis, making it impossible to accurately locate the implementer and intervention point of the hijacking behavior, reducing the effectiveness of security protection.

[0005] Most of the existing technologies only focus on the correctness verification of the domain name resolution result, ignoring the path consistency analysis in the resolution process. Domain name resolution hijacking occurs at any link in the communication chain, and checking the final resolution result cannot fully cover various hijacking scenarios, especially those complex hijacking methods achieved through man-in-the-middle attacks, which are difficult to be effectively identified and defended by traditional methods. SUMMARY

[0006] The embodiments of the present application provide an embedded device domain name resolution hijacking detection and tracing method and system, which can solve the problems in the prior art.

[0007] The first aspect of the embodiment of the application provides an embedded device domain name resolution hijacking detection and tracing method, comprising:

[0008] Full-process collection is performed on the out-bound and in-bound domain name resolution related messages in the network protocol stack of the embedded device, a request side record is constructed for each resolution request, a response side record is constructed for the received response message, and pairing is performed based on the same transaction identifier;

[0009] When the time delay vector deviates from the confidence interval adaptively learned by the same domain name and the same interface under the same network load interval, the transaction is determined as a suspicious transaction, and enters a tracing stage; and the path consistency fingerprint and the resolution result consistency index are cached as tracing input evidence with the suspicious mark, so that the suspicious determination and the pairing original data and the calculation intermediate quantity have a corresponding relationship and can be cross-checked in subsequent tracing;

[0010] In the tracing stage, a candidate intervention point set is constructed along the reverse sequence of the data forwarding path according to the resolution record in the suspicious transaction, and time sequence correlation test and bypass verification are performed on each candidate intervention point; for the candidate intervention point passing the time sequence correlation test and the bypass verification, a tracing result is generated, and the tracing result and the log data of the suspicious transaction are integrally encapsulated in a non-repudiable manner.

[0011] Constructing a request side record for each resolution request, constructing a response side record for the received response message, and pairing based on the same transaction identifier comprises:

[0012] When a domain name resolution request is detected, the request is copied in the sending path of the protocol stack and a request side record is constructed, and when a domain name resolution response corresponding to the request is received, the response is copied in the receiving path of the protocol stack and a response side record is constructed; pairing is performed based on the same transaction identifier in the request side record and the response side record to generate a transaction record;

[0013] Field-level consistency verification is performed according to the transaction record, when the field-level consistency verification passes, a standardized transaction record with a time sequence index is formed and written into a cyclic persistent area; when the field-level consistency verification does not pass, an abnormal transaction record is generated according to the same transaction identifier, and the difference field and the time stamp difference are recorded, so as to ensure the integrity of the record and the pairing.

[0014] When the time delay vector deviates from the confidence interval adaptively learned by the same domain name and the same interface under the same network load interval, the transaction is determined as a suspicious transaction, and enters a tracing stage, comprising:

[0015] In the online transaction process of the target domain name and the target interface, three network index parameters in the request stage are acquired, and round-trip time consumption is calculated after the transaction is completed, the three network index parameters and the round-trip time consumption are combined to form a corresponding delay vector; for transactions with transmission failures, consistency checking is performed based on transmission sequence integrity and confirmation number incrementality, and a checked delay vector sequence is generated;

[0016] Based on the occurrence time information of each transaction in the delay vector sequence, the transaction is uniquely mapped to the corresponding network load interval; a non-parametric density estimation method with robust loss and adaptive bandwidth is used to independently generate a delay probability distribution corresponding to the target domain name and the target interface for the delay vector samples in each network load interval, and the delay confidence interval of each load interval is calculated under a pre-set confidence level;

[0017] The current transaction is constructed into a delay vector, and the current network load interval corresponding to the transaction is determined according to the occurrence time information of the transaction, and the delay vector, the current network load interval and the delay confidence interval are compared; when the delay vector deviates from the corresponding delay confidence interval, a suspicious judgment is output for the transaction, and the tracing stage is entered.

[0018] Using a non-parametric density estimation method with robust loss and adaptive bandwidth, a delay probability distribution corresponding to the target domain name and the target interface is independently generated for the delay vector samples in each network load interval, and the delay confidence interval of each load interval is calculated under a pre-set confidence level, including:

[0019] Using a non-parametric density estimation method with robust loss and adaptive bandwidth, conditional learning is only performed in the round-trip time consumption dimension, and a delay probability distribution corresponding to the domain name interface network load interval is independently generated; under a pre-set confidence level, the upper and lower boundaries of the delay confidence interval of the domain name interface network load interval are calculated according to the delay probability distribution, and are associated with the corresponding key to form a boundary state containing boundary values and statistical quantities; a sliding window and a forgetting factor incremental update strategy are used to re-estimate the probability distribution and the upper and lower boundaries of the delay confidence interval online, and the updated boundary version and the latest update time are recorded to ensure that the boundary is traceable and converges smoothly;

[0020] In application scenarios that need to call the upper and lower boundaries of the delay confidence interval, the current transaction is formed into a delay vector and its belonging network load interval is determined according to the same rules of data preparation and interval mapping, and the delay confidence interval corresponding to the domain name interface network load interval and the latest valid version is read from the boundary state.

[0021] The path consistency fingerprint and the analysis result consistency index are cached as trace input evidence of the suspicious marker, suspicious determination and pairing original data and calculation intermediate quantity have corresponding relationship in subsequent trace and can be cross-checked, including:

[0022] The path consistency fingerprint, the analysis result consistency index and the suspicious marker are bound with the same transaction identifier to form trace input evidence that cannot be divided in semantics; the trace input evidence is assigned a version number and a time of occurrence, and an ordered index item identifying the version number is established, original data reference information is registered and calculation intermediate quantity reference information is calculated according to the ordered index item; the trace input evidence and the index item are cached in the audit storage, and the cache location and the index key are written back to the real-time determination record, ensuring that the trace input evidence can be uniquely located and consistently read with the same transaction identifier;

[0023] When the trace is triggered, the corresponding trace input evidence and its referenced original data and calculation intermediate quantity are retrieved according to the index key of the transaction identifier version number; the path consistency fingerprint is used as the main inspection clue, and the cross-checking is performed against the analysis result consistency index, and when the cross-checking passes, the pass conclusion and the transaction identifier version number are recorded in the audit storage; when the cross-checking fails, the inconsistent field, the corresponding time range and the involved index key are recorded, and the trace input evidence is marked as a review state.

[0024] In the trace stage, a candidate intervention point set is constructed along the reverse sequence of the data forwarding path according to the analysis record in the suspicious transaction, and time sequence correlation verification and bypass verification are performed on each candidate intervention point, including:

[0025] In the trace stage, the analysis record cached for the target suspicious transaction is read, the reverse sequence of the data forwarding path is constructed in the order from the end point to the start point based on the analysis record, and a mapping entry is generated for each node in the reverse sequence;

[0026] Based on the metric field vector of each mapping entry in the reverse sequence, each node is judged item by item according to the preset trigger rule, and the time window and the reference index in the mapping entry are involved in the judgment to generate a candidate intervention point description; the candidate intervention point descriptions are aggregated in the order in the reverse sequence to form a candidate intervention point set with sequential identification;

[0027] For each candidate intervention point in the candidate intervention point set, according to the time window and the trigger type in the candidate intervention point description, the metric field sequence of the candidate intervention point and its downstream nodes is extracted from the reverse sequence to construct a test input corresponding to the trigger type; the timing check record is calculated as a test result, when the check result is not lower than the preset check threshold, the candidate intervention point is marked as timing association pass, and the timing test statistic is formed; when any condition is not met, it is marked as timing association fails, and the conflict element is recorded in the timing test statistic as a constraint input for bypass verification.

[0028] For the candidate intervention points passing the timing association test and the bypass verification, generating a traceability result, and performing non-repudiable integrity encapsulation of the traceability result and the log data of the suspicious transaction includes:

[0029] Marking the candidate intervention points passing the timing association test and the bypass verification as important confidence intervention points, and generating input records;

[0030] According to the input records, extracting log fingerprints having a causal association with the important confidence intervention points in chronological order to form evidence elements; binding the evidence elements and the verification statistic summary of the important confidence intervention points, and sequentially concatenating them into a traceability result sequence, and generating a result index list;

[0031] Performing hierarchical summary calculation on the traceability result sequence to generate a three-order log, using the three-order log as the encapsulation data to construct an encapsulation header; digitally signing the encapsulation header using a controlled private key to form an integrity signature, combining the integrity signature and the encapsulation header to obtain an integrity encapsulation object, and performing a verification process on the integrity encapsulation object, and generating an anti-repudiation verification record when all verifications pass.

[0032] The second aspect of the embodiment of the application provides an embedded device domain name resolution hijacking detection and traceability system, which comprises:

[0033] A first unit is configured to collect all outbound and inbound domain name resolution related packets in the network protocol stack of the embedded device, construct a request side record for each resolution request, construct a response side record for the received response packet, and pair them with the same transaction identifier; based on the pairing result, calculate the time delay vector, path consistency fingerprint, and resolution result consistency index corresponding to the transaction identifier;

[0034] a second unit configured to determine that the transaction is a suspicious transaction when the time delay vector deviates from a confidence interval obtained by adaptive learning of historical homonymous names and homonymous interfaces in the same network load interval, and enter a tracing stage; and cache the path consistency fingerprint and the resolution result consistency index as tracing input evidence with the suspicious mark, so that suspicious determination and pairing original data and calculation intermediate quantities have a corresponding relationship and can be cross-checked in subsequent tracing;

[0035] a third unit configured to construct a candidate intervention point set along a reverse sequence of a data forwarding path according to resolution records in the suspicious transaction in the tracing stage, and perform timing correlation verification and bypass verification on each candidate intervention point; for a candidate intervention point passing the timing correlation verification and the bypass verification, generate a tracing result, and perform non-repudiable integrity encapsulation on the tracing result and log data of the suspicious transaction.

[0036] In a third aspect, an electronic device is provided, including:

[0037] a processor;

[0038] a memory for storing processor-executable instructions;

[0039] The processor is configured to invoke the instructions stored in the memory to execute the method described above.

[0040] In a fourth aspect, a computer-readable storage medium is provided, which stores computer program instructions, and the computer program instructions are executed by a processor to implement the method described above.

[0041] The present application has the following beneficial effects:

[0042] The present application constructs a systematic domain name resolution hijacking detection mechanism by collecting and pairing analysis of domain name resolution packets in the embedded device network protocol stack, effectively improves the accuracy and real-time performance of detection, and reduces the false positive rate.

[0043] The adaptive learning time delay vector confidence interval determination method, combined with the path consistency fingerprint and the resolution result consistency index, realizes accurate identification of multiple types of hijacking behaviors, can adapt to the change characteristics in different network environments, and improves the robustness of detection.

[0044] The tracing method of the present application can accurately locate the source of hijacking by constructing a candidate intervention point set and performing timing correlation verification and bypass verification, and at the same time, uses a non-repudiable integrity encapsulation mechanism to ensure the reliability and legal effect of the evidence, providing a solid foundation for subsequent security protection and accountability. BRIEF DESCRIPTION OF DRAWINGS

[0045] Figure 1 A flowchart of the method for detecting and tracing domain name resolution hijacking of an embedded device according to an embodiment of the present application is shown in FIG. 1.

[0046] Figure 2 A flowchart of the method for evidence collection and integrity verification based on version index according to an embodiment of the present application is shown in FIG. 2. DETAILED DESCRIPTION

[0047] To make the objectives, technical solutions, and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described below in connection with the drawings of the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0048] The technical solutions of the present application will be described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes can not be described in some embodiments.

[0049] Figure 1 A flowchart of the method for detecting and tracing domain name resolution hijacking of an embedded device according to an embodiment of the present application is shown in FIG. 1. Figure 1 As shown in FIG. 1, the method comprises the following steps.

[0050] The out-bound and in-bound domain name resolution related messages in the network protocol stack of the embedded device are collected in the whole process, the request side record is constructed for each resolution request, the response side record is constructed for the received response message, and the records are paired with the same transaction identifier; the time delay vector, the path consistency fingerprint, and the resolution result consistency index corresponding to the transaction identifier are calculated based on the pairing result;

[0051] When the time delay vector deviates from the confidence interval adaptively learned from the same domain name and the same interface in the same network load interval, the transaction is determined as a suspicious transaction, and enters the tracing stage; and the path consistency fingerprint and the resolution result consistency index are cached as tracing input evidence with the suspicious mark, so that the suspicious determination, the pairing original data, and the calculation intermediate quantity have a corresponding relationship and can be cross-checked in the subsequent tracing;

[0052] In the tracing stage, the candidate intervention point set is constructed along the reverse sequence of the data forwarding path according to the resolution record in the suspicious transaction, and the time sequence correlation test and the bypass verification are performed on each candidate intervention point; for the candidate intervention point passing the time sequence correlation test and the bypass verification, the tracing result is generated, and the tracing result and the log data of the suspicious transaction are integrity encapsulated in a non-repudiable manner.

[0053] In an alternative embodiment, a request-side record is constructed for each resolution request, while a response-side record is constructed for each received response packet, and the pairing is performed based on the same transaction identifier, including:

[0054] Upon detecting a domain name resolution request, the request is copied in the sending path of the protocol stack and a request-side record is constructed, and upon receiving a domain name resolution response corresponding to the request, the response is copied in the receiving path of the protocol stack and a response-side record is constructed; the pairing is performed based on the same transaction identifier in the request-side record and the response-side record, and a transaction record is generated;

[0055] Field-level consistency verification is performed according to the transaction record, when the field-level consistency verification passes, a standardized transaction record with a time sequence index is formed and written into a cyclic persistent area; when the field-level consistency verification fails, an abnormal transaction record is generated according to the same transaction identifier and the difference field and time stamp difference are recorded, ensuring the integrity of the record and pairing.

[0056] By implementing full-process transaction association and abnormality detection in a domain name resolution system, the reliability and security of domain name resolution services can be effectively guaranteed. The technical solution can be applied to various domain name resolution service systems, including but not limited to enterprise intranet DNS servers, public DNS services, and local domain name resolution services on edge computing nodes.

[0057] A monitoring point is implanted in the kernel protocol stack of the DNS server system, and interception processing is performed in the sending path and the receiving path of the network data packet, respectively. For a domain name resolution request, when the system detects a new DNS request packet, the request packet is captured in the protocol stack sending path through a hook function, without affecting the normal sending of the original request. The captured request data packet is copied, and enters the data packet analysis module. The module analyzes the binary data of the DNS request packet into structured information, extracts fields including transaction ID, request domain name, query type, recursion expectation flag, etc., and constructs a request-side record.

[0058] For example, when a user queries the A record of "example.com", the request information in the form of "ID: 12345, QNAME: example.com, QTYPE: A, RD: 1" is captured. These information is organized into a request-side record, and the system timestamp when captured, such as "2023-01-01 12:00:00.123", is attached, and stored in a temporary request record pool.

[0059] A hook function is set on the receiving path of the protocol stack to capture the inbound DNS response packet. When a DNS response packet is detected, the system duplicates the packet and parses it to extract the transaction ID, response code, answer resource records, and other information, and constructs the response-side record. For the above request, the system receives the response information "ID: 12345, RCODE: 0, ANSWERS: [{NAME: example.com, TYPE: A, TTL: 600, DATA: 192.0.2.1}]", and also adds the reception timestamp.

[0060] The transaction pairing module periodically scans the request record pool and the response record pool and matches them based on the transaction ID. For the example, the system finds the request and response records with ID 12345 and combines them into a complete transaction record. After successful pairing, the system calculates the time difference between the request and the response, such as 25 milliseconds, and records it as the resolution delay indicator.

[0061] For the successfully paired transaction record, the system performs field-level consistency verification, which includes but is not limited to verifying whether the domain name in the response matches the domain name in the request, verifying whether the response type matches the request type, and checking whether the recursion available flag in the response meets the expectation. In the example, the system checks whether "example.com" in the response matches the domain name in the request, and whether the record type A in the response matches the request.

[0062] When the field-level consistency verification passes, the transaction record is standardized, including uniform field name format, standardized value representation, and adding the transaction start time as a time series index. The processed record is in the form of "{txid: 12345, timestamp: 1672574400123, qname: 'example.com', qtype: 'A', rcode: 0, answers: [{type: 'A', ttl: 600, data: '192.0.2.1'}], latency: 25}", and these records are written to the system's cyclic persistent storage area, which is organized in a segmented file manner and uses the storage space according to the configured retention policy.

[0063] When the field-level consistency check fails, for example, the request queries "example.com" but the answer returns "exampie.com" (note the spelling error), the system generates an exception transaction record. In addition to containing all the information of a normal transaction record, the exception record also specifically marks the difference field, such as "{txid:12345,timestamp:1672574400123,qname:'example.com', error_fields:[{field:'answer.name', expected:'example.com', actual:'exampie.com'}], latency:25}". At the same time, the time difference between the request sending time and the answer receiving time is recorded, which is used for subsequent analysis of the time distribution characteristics of the exception occurrence.

[0064] For requests that have not received an answer for more than a preset time threshold (such as 5 seconds), a timeout record is generated and marked as unpaired. For answers that are received but cannot find the corresponding request, an orphan answer record is created. These abnormal cases are distinguished by special markers to ensure the integrity of the transaction record.

[0065] To improve system performance, the system uses the memory-mapped file technology for efficient persistent storage, uses the lock-free ring buffer for record transfer, and reduces the frequency of I / O operations through the batch write mechanism. In a high-concurrency scenario, such as an environment that processes 10,000 DNS requests per second, the additional CPU overhead of this implementation is controlled within 2%, the memory usage increases by no more than 50MB, and the storage space consumption can be flexibly configured according to the retention policy. Under typical configuration, about 300MB of storage space is required per day.

[0066] Through the above implementation, the entire domain name resolution process is effectively monitored, and the resolution exception is quickly located, providing complete transaction tracking capability, and providing strong data support for DNS service operation and security analysis.

[0067] In an optional implementation, when the latency vector deviates from the confidence interval adaptively learned by the same domain name and the same interface under the same network load interval, the transaction is determined as a suspicious transaction, and enters the tracing stage, including:

[0068] In the online transaction processing process for the target domain name and the target interface, the three-network indicator parameters in the request stage are obtained, and the round-trip time is calculated after the transaction is completed. The three-network indicator parameters and the round-trip time are combined to form a corresponding latency vector. For transactions with transmission faults, consistency check is performed based on transmission sequence integrity and confirmation number incrementality, and a checked latency vector sequence is generated.

[0069] Based on the time delay vector sequence of each transaction, the transaction is uniquely mapped to the corresponding network load interval; using a robust loss and adaptive bandwidth non-parametric density estimation method, the time delay vector sample in each network load interval is independently generated to obtain the time delay probability distribution corresponding to the target domain name and the target interface, and the time delay confidence interval of each load interval is calculated under the pre-set confidence level;

[0070] The time delay vector of the current transaction is constructed, the corresponding current network load interval is determined according to the time of occurrence of the transaction, and the time delay vector, the current network load interval and the time delay confidence interval are compared; when the time delay vector deviates from the corresponding time delay confidence interval, the suspicious judgment of the transaction is output, and the tracing stage is entered.

[0071] The online transaction monitor obtains the three-network index parameters in the request stage in the process of transaction processing for the target domain name and the target interface. The three-network index parameters include the data packet transmission index of the network layer, the connection establishment index of the transmission layer, and the protocol interaction index of the application layer. The network layer index includes the number of sent and received data packets, the packet loss rate and the retransmission times. The transmission layer index includes the establishment time of TCP connection, the handshake delay, the window size change and the congestion control state. The application layer index includes the initiation time of HTTP request, the response reception time, the content length and the status code information. The index acquisition process is realized through network interface listening and protocol stack hook, ensuring the real-time and accuracy of the index data.

[0072] The round-trip time calculation module accurately calculates the round-trip time of the request after the transaction is completed. The calculation process records the accurate time stamp of the request initiation and the accurate time stamp of the complete response reception. The difference between the two time stamps is the round-trip time. The time stamp uses a high-precision clock source, accurate to the microsecond level, ensuring the accuracy of the round-trip time measurement. The calculation process considers the comprehensive influence of network transmission delay, server processing delay and local protocol stack processing delay. After the round-trip time calculation is completed, the time delay vector constructor combines the three-network index parameters and the round-trip time according to the pre-defined data structure format to form the complete time delay vector of the corresponding transaction.

[0073] The transmission fault detector identifies transactions with transmission faults and performs special verification processing on these transactions. The identification of transmission faults is based on abnormal indexes of the network layer and the transmission layer, including data packet loss, retransmission timeout, connection interruption and protocol error, etc. The transmission sequence integrity verifier checks the continuity of the sequence number of the data packet, and verifies whether the sequence of the sent and received data packet is complete without missing. The verification process identifies sequence interruption, repetition and disorder by comparing the expected sequence number with the actual received sequence number. The acknowledgement number incrementality verifier verifies the monotonic increasing property of the TCP acknowledgement number, and checks whether the acknowledgement number is correctly incremented according to the protocol specification.

[0074] The consistency check algorithm synthesizes the check results of transmission sequence integrity and confirmation number incrementality to generate the checked latency vector sequence. The check process specially marks the transactions detected to have transmission faults, and adds fault type identification and fault severity rating in the latency vector. The check algorithm adjusts the relevant indicator values in the latency vector according to the fault type, and corrects or marks the abnormal latency values caused by transmission faults. The checked latency vector sequence maintains the integrity of the original data, while providing supplementary information related to faults, ensuring that the subsequent analysis process can correctly handle abnormal situations.

[0075] The network load interval mapper uniquely maps each transaction in the latency vector sequence to the corresponding network load interval based on the occurrence time information of the transaction. The occurrence time information includes the transaction start time, peak period identification, and network load intensity rating. The division of network load intervals is based on historical network traffic patterns and load characteristics, and usually includes different levels such as low load, medium load, high load, and peak load. The mapping process determines the corresponding network load interval identification by looking up the time period to which the occurrence time belongs. The mapping algorithm takes into account the periodic characteristics of time, such as the difference between weekdays and weekends, and load patterns at different times, to ensure the accuracy and consistency of the mapping results.

[0076] The non-parametric density estimator performs independent probability distribution generation on the latency vector samples in each network load interval. The estimation process uses a kernel density estimation method with a robust loss function to reduce the influence of abnormal samples on distribution estimation. The adaptive bandwidth selection algorithm dynamically adjusts the kernel function bandwidth according to the distribution characteristics of samples in each load interval, using smaller bandwidth in sample dense areas to improve accuracy, and larger bandwidth in sample sparse areas to enhance smoothness. The estimator generates independent latency probability distributions for each target domain name and target interface combination in each network load interval, ensuring the relevance and accuracy of the distribution estimation.

[0077] The confidence interval calculator calculates the latency confidence interval for each load interval based on the generated latency probability distribution and the preset confidence level. The confidence level is set to ninety-five percent, indicating that the confidence interval contains normal latency values with a probability of ninety-five percent. The calculation process determines the upper and lower boundaries of the confidence interval through the cumulative distribution function, with the lower boundary corresponding to the latency value with a cumulative probability of two and a half percent, and the upper boundary corresponding to the latency value with a cumulative probability of ninety-seven and a half percent. The calculation of the confidence interval uses numerical integration and interpolation methods to ensure the accuracy of the boundary values. The calculated confidence interval is associated with the corresponding domain name interface combination and network load interval to form a complete confidence interval database.

[0078] The current transaction processor constructs a corresponding delay vector for the real-time collected transaction. The construction process follows the same data collection and processing rules as the historical transactions, ensuring the consistency of the delay vector format. The delay vector of the current transaction contains the same three-network indicator parameters and round-trip time information, using the same data structure and precision requirements. If there is a transmission failure in the current transaction, the processor performs the same consistency check process and generates a standardized delay vector.

[0079] The network load interval determiner determines the corresponding current network load interval of the current transaction according to the occurrence time information of the current transaction. The determination process uses the same mapping rules and time period division standards as the historical transactions, ensuring the consistency of the load interval determination. The determiner monitors the current network load state in real time and accurately identifies the network load interval to which it belongs, combining the time characteristics of the transaction occurrence time. The determination of the load interval considers dynamic factors such as real-time network traffic, concurrent connection number, and bandwidth utilization.

[0080] The delay comparator performs detailed comparison operations between the delay vector of the current transaction and the corresponding confidence interval. The comparison process retrieves confidence interval information from the confidence interval database that completely matches the domain name interface combination and network load interval of the current transaction. The comparison algorithm checks whether each indicator value in the delay vector falls within the corresponding confidence interval range. For the round-trip time indicator, the comparator determines whether the measured value is between the upper and lower boundaries of the confidence interval. For the three-network indicator parameters, the comparator checks whether each indicator is within the normal variation range.

[0081] The deviation detector identifies the specific circumstances of the deviation of the delay vector from the confidence interval. Deviation detection includes absolute deviation and relative deviation. Absolute deviation refers to the indicator value completely exceeding the confidence interval boundary, and relative deviation refers to the indicator value being close to the boundary but having an abnormal change trend. The detector calculates quantitative indicators of the deviation degree, including deviation distance, deviation proportion, and deviation duration. The evaluation of the deviation degree considers the importance weight of the indicator. The round-trip time is the main indicator with a higher weight, and the three-network indicator parameters are auxiliary indicators with a relatively lower weight.

[0082] The suspiciousness determiner outputs the suspiciousness determination of the transaction based on the deviation detection results. The determination process uses a multi-level determination mechanism. Minor deviation is marked as low suspiciousness, moderate deviation is marked as medium suspiciousness, and severe deviation is marked as high suspiciousness. The suspiciousness determination considers the number of deviation indicators, the degree of deviation, and the comprehensive influence of the deviation mode. When there is significant deviation in the delay vector and the deviation mode meets the abnormal characteristics, the determiner outputs the suspicious transaction identifier, triggering the start of the tracing phase.

[0083] The trace trigger receives suspicious decision results, starts the trace processing flow of the corresponding transaction, and triggers the process to pass the complete information of the current transaction to the trace module, including the delay vector, network load interval, deviation details, and decision basis. The start of the trace stage adopts an asynchronous processing mechanism to avoid affecting the performance of the current transaction processing. The trigger records the trace start time and the triggering reason to provide basic information for subsequent trace result evaluation.

[0084] In an optional implementation, a non-parametric density estimation method with robust loss and adaptive bandwidth is used to independently generate the delay probability distribution corresponding to the target domain name and target interface for the delay vector samples in each network load interval, and the delay confidence interval of each load interval is calculated under a preset confidence level, including:

[0085] A non-parametric density estimation method with robust loss and adaptive bandwidth is used to perform conditional learning only in the round-trip time dimension, independently generating the delay probability distribution corresponding to the domain name interface network load interval; under a preset confidence level, the upper and lower boundaries of the delay confidence interval of the domain name interface network load interval are calculated based on the delay probability distribution, and are associated with the corresponding key to form a boundary state containing boundary values and statistical quantities. An incremental updating strategy using a sliding window and a forgetting factor is used to perform online re-estimation of the probability distribution and the upper and lower boundaries of the delay confidence interval, and the updated boundary version and the latest update time are recorded to ensure traceability and smooth convergence of the boundaries;

[0086] In application scenarios that require calling the upper and lower boundaries of the delay confidence interval, the delay vector of the current transaction is formed and its network load interval is determined according to the same rules of data preparation and interval mapping, and the delay confidence interval corresponding to the domain name interface network load interval and the latest valid version is read from the boundary state.

[0087] The non-parametric density estimator performs conditional learning processing on the delay vector samples in each network load interval. The conditional learning process is only performed in the round-trip time dimension, ignoring other factors that affect the delay distribution, ensuring the specificity and accuracy of the estimation results. The delay vector sample contains the round-trip time measurement values of each network request, which are grouped according to domain name and interface identifier. Each group corresponds to a specific domain name interface combination. The sample preprocessing module cleans and standardizes the original delay data, removes obvious outliers and measurement errors, and ensures the quality and reliability of the sample data.

[0088] The implementation of the robust loss function adopts a Huber loss mechanism, which combines the advantages of square loss and absolute value loss. When the deviation between the time delay sample value and the estimated value is less than a preset threshold, the loss function adopts a square loss form, providing smooth gradient characteristics. When the deviation exceeds the threshold, the loss function switches to an absolute value loss form, reducing the degree of influence of abnormal values on the overall estimation result. The threshold parameter is dynamically adjusted according to the statistical characteristics of the time delay data, and the appropriate threshold setting is determined by analyzing the standard deviation and quartile range of the sample data. The calculation process of the robust loss function evaluates the contribution of each time delay sample point to the overall density estimation, and the weight of abnormal sample points is automatically reduced.

[0089] The adaptive bandwidth selection algorithm dynamically determines the bandwidth parameter of the kernel function according to the distribution characteristics of the time delay samples. The bandwidth selection process uses a cross-validation method to divide the time delay samples into a training set and a validation set, and determines the optimal bandwidth value by minimizing the prediction error on the validation set. The adaptive mechanism considers the local variation characteristics of sample density, using a smaller bandwidth in sample dense areas to improve resolution, and using a larger bandwidth in sample sparse areas to enhance smoothness. The bandwidth calculation process uses a grid search algorithm to select the bandwidth value that minimizes the cross-validation error from a predefined set of bandwidth candidates.

[0090] The kernel density estimator uses a Gaussian kernel function to estimate the probability density of the time delay samples. Each time delay sample point serves as the center of a kernel function, and the bandwidth parameter of the kernel function is determined by the adaptive bandwidth selection algorithm. The probability density function is calculated by the weighted average of all kernel functions, and the weight is determined by the robust loss function. The density estimation process calculates the probability density value in the continuous time delay value domain to form a complete time delay probability distribution curve. The calculation of the probability distribution uses a numerical integration method to ensure that the integral value of the entire distribution function is equal to one.

[0091] The time delay confidence interval calculation module calculates the upper and lower boundaries of the confidence interval based on the generated time delay probability distribution and the preset confidence level, which is usually set to ninety-five percent or ninety-nine percent, representing the probability that the confidence interval contains the true time delay value. Confidence interval calculation is achieved through the inverse function of the cumulative distribution function. The lower boundary corresponds to the time delay value where the cumulative probability is equal to half minus half of the confidence level, and the upper boundary corresponds to the time delay value where the cumulative probability is equal to half plus half of the confidence level. The cumulative distribution function is calculated by numerically integrating the probability density function.

[0092] The boundary state manager establishes an independent boundary state record for each combination of domain name interface and network load interval, which contains the upper boundary value, lower boundary value, statistical quantity summary and association key information of the confidence interval. The statistical quantity summary contains descriptive statistical indicators such as sample size, sample mean, sample standard deviation, skewness coefficient and kurtosis coefficient. The association key information includes domain name identifier, interface identifier, network load interval identifier and calculation timestamp, which ensures accurate association between boundary state and corresponding latency data.

[0093] The sliding window mechanism dynamically manages latency samples, maintaining a fixed-size sample window for online updating of the probability distribution. The size of the sliding window is determined according to the variation frequency and stability requirements of the latency data, usually containing several hundred to several thousand recent latency samples. When a new latency sample arrives, the sliding window removes the oldest sample and adds the new sample, keeping the window size unchanged. The window updating process uses a ring buffer data structure to improve the efficiency of sample addition and removal.

[0094] The forgetting factor mechanism assigns different weights to samples at different times, with recent samples having higher weights and older samples having lower weights. The value of the forgetting factor is between zero and one, with a value closer to one indicating a higher degree of preservation of historical data, and a value closer to zero indicating a higher degree of emphasis on the latest data. The weight calculation process determines the power of the forgetting factor based on the time interval between the sample and the current time, with a longer time interval resulting in a larger power and a smaller weight. The setting of the forgetting factor takes into account the speed of change of the network environment and the stability characteristics of the latency distribution.

[0095] The incremental updating strategy updates the probability distribution and confidence interval in real time when a new sample arrives, and the incremental updating process avoids recalculating the entire probability distribution, but instead makes local adjustments to the existing distribution based on the new sample. The updating algorithm calculates the incremental contribution of the new sample to each point of the probability density function, and adds the incremental value to the existing density value. The update of the confidence interval is realized by recalculating the key quantile points of the cumulative distribution function, only the cumulative probability values near the confidence interval need to be calculated.

[0096] The boundary version manager assigns a unique version number to each update operation, records the timestamp and update content summary of the update operation. The version number uses an incremental integer sequence to ensure the uniqueness and time sequence of the version. The update time is recorded to the millisecond level, supporting high-frequency update operations. The version history record is saved in a special version management table, supporting historical query and backtracking operations of the boundary state.

[0097] The smooth convergence monitor evaluates the convergence of probability distribution and confidence interval by comparing the difference between successive updated versions to determine the convergence state. The convergence metrics include the Kolmogorov-Smirnov distance of probability distribution, the relative change rate of confidence interval boundary values, and the stability indicators of statistics. When the change amount of successive multiple updates is less than the preset convergence threshold, the monitor determines that the distribution has reached the smooth convergence state.

[0098] The latency vector constructor processes the latency data of the current transaction in the application invocation scenario according to the same rules as in the training phase. The construction process extracts the round-trip time measurement value of the current transaction, and performs the same preprocessing and standardization operations as the training samples. The network load interval determiner determines the network load interval according to the current network state and transaction characteristics, and uses the same interval division standard and judgment rule as in the training phase.

[0099] The boundary queryer retrieves the corresponding confidence interval information from the boundary state storage according to the domain name interface combination of the current transaction and the network load interval. The query process uses the association key as the index to quickly locate the matching boundary state record. The version selector selects the latest and valid version from the matching record to ensure that the returned confidence interval reflects the latest network latency characteristics. The query result includes the upper and lower boundary values of the confidence interval, the corresponding statistics, and the version information, providing complete latency prediction basis for the application.

[0100] In an optional implementation, the path consistency fingerprint and the analysis result consistency index are cached as trace input evidence with the suspicious mark, so that the suspicious determination and the pairing of original data and intermediate quantities have a corresponding relationship in subsequent trace and can be cross-checked.

[0101] The path consistency fingerprint, the analysis result consistency index, and the suspicious mark are bound with the same transaction identifier to form trace input evidence that is semantically indivisible. The trace input evidence is assigned a version number and a time of occurrence, and an ordered index item identifying the version number is established. The original data reference information and the intermediate quantity reference information are registered according to the explicit registration of the ordered index item. The trace input evidence and its index item are cached in the audit storage, and the cache location and the index key are written back to the real-time determination record, ensuring that the trace input evidence can be uniquely located and consistently read with the same transaction identifier.

[0102] When the traceability is triggered, the corresponding traceability input evidence and its referenced original data and calculation intermediate quantities are retrieved according to the index key of the transaction identification version number; the path consistency fingerprint is used as the main inspection clue, the cross-checking is performed against the analysis result consistency index, and when the cross-checking passes, the passing conclusion is recorded to the audit storage together with the transaction identification version number; when the cross-checking fails, the inconsistent fields, corresponding time range and involved index key are recorded, and the traceability input evidence is marked as a recheck state.

[0103] As shown in Figure 2 , the method comprises:

[0104] The evidence binding module receives three data components of the path consistency fingerprint, the analysis result consistency index and the suspicious marker, and establishes a unified binding relationship through the transaction identifier. The binding process creates a data structure of the traceability input evidence, which contains a transaction identifier field, a path consistency fingerprint field, an analysis result consistency index field and a suspicious marker field. The transaction identifier serves as the primary key to ensure the semantic indivisibility of the three components, and any access operation on the traceability input evidence must be performed through the unified transaction identifier.

[0105] The path consistency fingerprint field stores the integrity check information of the data flow path, including the hash value of the path node sequence, the check code of the path jump relationship and the consistency identifier of the path timing. The analysis result consistency index field records the quality measurement information of the data analysis process, including the analysis success rate, the data integrity proportion, the format consistency score and the semantic correctness index. The suspicious marker field includes the suspicious degree rating, the suspicious type classification, the detection timestamp and the trigger rule identifier.

[0106] The version manager assigns a unique version number and an accurate occurrence time to the generated traceability input evidence. The version number is generated in an incremental integer sequence, ensuring that each traceability input evidence has a unique version identifier. The occurrence time records the accurate timestamp of the creation of the traceability input evidence, using a high-precision time measurement unit to ensure the accuracy of the timing. The allocation process of the version number and the occurrence time uses an atomic operation mechanism to prevent version conflicts and timestamp duplication in a concurrent environment. After the allocation is completed, the version manager combines the version number, the occurrence time and the corresponding transaction identifier to form a version identification triple.

[0107] The index builder establishes ordered index items based on version identification triples. The ordered index items adopt a balanced binary search tree data structure, and are organized by version number as the primary sorting key and occurrence time as the auxiliary sorting key. Each node of the index item contains a version number, occurrence time, transaction identifier, and a pointer to the storage location of the provenance input evidence. The index tree supports fast lookup based on version number, interval query based on time range, and precise positioning operation based on transaction identifier. The index building process adopts a self-balancing algorithm to ensure that the lookup performance of the index tree remains at a logarithmic level.

[0108] The original data reference information register performs an explicit registration operation based on the ordered index items. The registration process scans all original data sources involved in the provenance input evidence, extracts the identifier, storage location, data format, and access permission information of each data source. The original data reference information includes the complete path of the data source, data version identification, data size, creation time, and last modification time. The register organizes this information into an original data reference table, and each table entry contains data source identifier, reference relationship type, dependency strength, and access frequency, etc. The original data reference table is associated with the provenance input evidence as a foreign key to ensure the integrity and consistency of the reference relationship.

[0109] The calculation intermediate quantity reference information calculator analyzes all intermediate calculation results generated during the generation of the provenance input evidence. The calculation process identifies the intermediate hash value in the path consistency fingerprint generation process, the temporary statistics in the result consistency index calculation process, and the scoring intermediate value in the suspicious marker determination process. Each calculation intermediate quantity is assigned a unique identifier, and records its calculation method, input parameter, output result, and calculation timestamp. The calculation intermediate quantity reference information includes the data type, storage format, dependency relationship, and life cycle information of the intermediate quantity. The calculator establishes a calculation intermediate quantity reference table to record the complete dependency relationship graph between the intermediate quantity and the original data and the final result.

[0110] The audit storage manager caches the provenance input evidence and its associated index items to a dedicated audit storage space. The audit storage adopts a distributed storage architecture to ensure the high availability and persistence of data. The storage process stores the provenance input evidence according to the transaction identifier, and each shard contains complete evidence data, index information, and reference relationship data. The storage manager generates a unique cache location identifier for each stored provenance input evidence, which records the specific location information of the data in the distributed storage, including storage node identifier, shard identifier, and offset information.

[0111] The cache location backwriter writes the generated cache location identifier and the corresponding index key to the real-time judgment record, updates the provenance location field in the real-time judgment record, and ensures that subsequent provenance operations can quickly locate the corresponding provenance input evidence through the transaction identifier. The index key includes the combination of the transaction identifier, the version number, and the cache location identifier, forming complete positioning information. The backwriting operation adopts a transactional writing mechanism to ensure the consistency of the cache location information and the provenance input evidence. After the backwriting is completed, the real-time judgment record has complete provenance capability, supporting unique positioning and consistent reading operations based on the same transaction identifier.

[0112] The provenance trigger detector monitors the arrival of provenance requests, and when a provenance trigger signal is detected, the evidence retriever retrieves the corresponding provenance input evidence from the audit storage according to the index key composed of the transaction identifier and the version number. The retrieval process quickly locates the storage location of the target provenance input evidence through the index key in the ordered index item. The evidence retriever simultaneously loads the original data reference information and the calculation intermediate quantity reference information associated with the provenance input evidence, ensuring that the provenance process has complete data basis. The retrieval operation adopts a pre-reading mechanism to load the required associated data into the memory in advance, improving the execution efficiency of the provenance process.

[0113] The cross-check executor takes the path consistency fingerprint as the main verification clue, and performs detailed cross-check operations against the analysis result consistency index. The cross-check process includes three stages: path integrity verification, analysis result verification, and consistency comparison. In the path integrity verification stage, the consistency fingerprint of the data flow path is recalculated, and the calculation result is compared bit by bit with the stored path consistency fingerprint to verify the integrity and accuracy of the path information. In the analysis result verification stage, the quality indicators of the analysis process are re-evaluated, and the recalculated indicator values are compared with the stored analysis result consistency index for verification. In the consistency comparison stage, the logical correlation between the path consistency fingerprint and the analysis result consistency index is analyzed to verify whether there is a mutual supporting consistency relationship between the two.

[0114] The cross-check result determinator determines the pass according to the execution result of the cross-check. When the path integrity verification passes, the analysis result verification passes, and the consistency comparison result shows that there is a reasonable correlation between the two indicators, the determinator determines that the cross-check passes. When the cross-check passes, the result recorder records the cross-check pass conclusion together with the corresponding transaction identifier and version number in the cross-check result table of the audit storage. The cross-check result record includes the cross-check execution time, the cross-check method identifier, the detailed verification results of each stage, and the overall cross-check conclusion. The recording operation adopts an append write mode to ensure the integrity and traceability of the cross-check history.

[0115] When the verification result of any stage in the cross-checking process is a failure state, the determinator determines that the cross-checking fails. When the cross-checking fails, the inconsistency analyzer analyzes the specific reasons for the cross-checking failure and the inconsistency manifestations in detail. The inconsistent field identifier locates the specific data field where the inconsistency occurs, records the field name, expected value, actual value, and deviation degree. The time range analyzer determines the time range of the occurrence of the inconsistency phenomenon, including the start timestamp, end timestamp, and duration. The index key association analyzer identifies all index keys related to the inconsistency phenomenon, establishing the association between the inconsistency phenomenon and the data source.

[0116] The review state marker marks the traceable input evidence that fails the cross-checking as a review-required state. The marking process sets a review identification bit in the state field of the traceable input evidence and records the marking timestamp and the marking reason. The review state record includes detailed information of the inconsistent field, the corresponding time range, and the list of index keys involved, providing detailed guidance information for subsequent manual review or automatic retry. The traceable input evidence in the review state is added to a special review queue for further processing and verification, ensuring that data quality problems are discovered and solved in a timely manner.

[0117] In an optional implementation, in the traceability stage, a candidate intervention point set is constructed according to the parsed records in the suspicious transaction along the reverse sequence of the data forwarding path, and a timing association test and bypass verification are performed on each candidate intervention point, including:

[0118] In the traceability stage, the parsed records cached for the target suspicious transaction are read, and a reverse sequence of the data forwarding path is constructed in the order from the end point to the start point based on the parsed records, and a mapping entry is generated for each node in the reverse sequence;

[0119] Based on the metric field vector of each mapping entry in the reverse sequence, each node is judged item by item according to a preset trigger rule, and the time window and reference index in the mapping entry are involved in the judgment to generate a candidate intervention point description; the candidate intervention point descriptions are aggregated in the order in the reverse sequence to form a candidate intervention point set with sequence identification;

[0120] For each candidate intervention point in the candidate intervention point set, a metric field sequence of the candidate intervention point and its downstream nodes is extracted from the reverse sequence according to the time window and trigger type in the candidate intervention point description to construct a test input corresponding to the trigger type; a timing check record is calculated as a test result, when the check result is not lower than a preset check threshold, the candidate intervention point is marked as timing association passed, and a timing test statistic is formed; when any condition is not met, it is marked as timing association failed, and the conflict elements are recorded in the timing test statistic as a constraint input for bypass verification.

[0121] The traceability module reads the resolution records for the target suspicious transaction from the cache memory, which contains all the data forwarding node information involved in the transaction execution process. Each node record contains a node identifier, a node type, a processing timestamp, an input data identifier, an output data identifier, and node state information. The cache read operation retrieves the corresponding resolution record set from the distributed cache by using the transaction identifier as the query key value. The read process uses a parallel read mechanism to obtain related data from multiple cache shards simultaneously, and reorganizes the shard data in timestamp order through a data merging algorithm to ensure the integrity and timing correctness of the resolution records.

[0122] Based on the read resolution records, the reverse sequence builder constructs the reverse sequence of the data forwarding path in the order from the end point to the start point. The construction process is implemented through a topological sorting algorithm, which is based on the data dependency relationship in the resolution records to establish a directed acyclic graph structure. Each node in the graph represents a data forwarding node, and the directed edge represents the data flow relationship. The reverse sequence construction starts from the final output node of the transaction and performs a depth-first traversal along the reverse direction of the data dependency relationship, recording all the nodes on the traversal path. During the traversal process, the algorithm checks the predecessor node set of each node to ensure that all predecessor nodes have been visited before adding the current node to the reverse sequence. The constructed reverse sequence maintains the reverse sequence structure of the data forwarding path, providing a basis for subsequent intervention point identification.

[0123] For each node in the reverse sequence, the mapping entry generator creates a corresponding mapping entry, which contains node basic information fields, metric field vectors, time window information, and reference index information. The node basic information field records the unique identifier of the node, the node type identifier, the belonging level, and the processing state. The metric field vector contains the performance metric values of the node, such as processing delay, throughput, error rate, resource usage, and other key indicators. The time window information contains the start timestamp, end timestamp, and valid time range of the node processing. The reference index information records the position index of the node in the original resolution record, the position index in the reverse sequence, and the association index with other nodes. The mapping entry is stored in a structured data format, supporting fast lookup and access operations.

[0124] The candidate intervention point identification module performs item-by-item judgment based on the metric field vector of each mapping entry in the reverse sequence. The judgment process uses a set of pre-set trigger rules, each of which defines specific judgment conditions and threshold parameters. The trigger rules include abnormal performance trigger rules, resource competition trigger rules, timing exception trigger rules, and state change trigger rules.

[0125] The abnormal performance trigger rule triggers the candidate intervention point identification by comparing the performance metric value of the node with the historical baseline value, when the deviation exceeds the preset threshold. The resource competition trigger rule identifies the resource contention and conflict situation by analyzing the resource usage mode of the node. The timing abnormality trigger rule checks the rationality of the node processing time, and identifies the abnormal delay or early completion situation. The state change trigger rule monitors the abnormal transition mode of the node state.

[0126] The decision process combines the time window and reference index information in the mapping entry for comprehensive evaluation. The time window information is used to determine the influence range and duration of the candidate intervention point, and the reference index information is used to establish the association relationship between the candidate intervention points. For the nodes that meet the trigger rule, the candidate intervention point description generator creates the corresponding candidate intervention point description. The candidate intervention point description includes the intervention point identifier, the trigger type, the trigger strength, the time window range, the influence range and the associated node information. The trigger type identifies the specific reason that causes the node to be identified as a candidate intervention point, and the trigger strength quantifies the abnormality degree or influence degree.

[0127] The candidate intervention point set constructor converges all candidate intervention point descriptions in the reverse sequence according to the order of the sequence, and assigns a unique sequence identifier to each candidate intervention point, which reflects the relative position of the candidate intervention point in the reverse sequence. The sequence identifier uses an incremental integer number to ensure that the processing order of the candidate intervention point is consistent with the reverse order of the data stream. After the convergence, a candidate intervention point set with sequence identifier is formed, which is stored in an ordered list data structure, supporting fast access and traversal operation according to the sequence identifier.

[0128] The timing association verification module performs timing association verification for each candidate intervention point in the candidate intervention point set. The verification process extracts the relevant metric field sequence from the reverse sequence according to the time window and trigger type information in the candidate intervention point description. The extraction range includes the candidate intervention point and all downstream nodes, and the determination of the downstream nodes is based on the data flow relationship and the timing sequence relationship. The metric field sequence extractor collects the metric field values of all nodes in the specified range in timestamp order to form a timing metric data set.

[0129] Based on the extracted metric field sequence, the verification input constructor creates the corresponding verification input data structure according to the trigger type. Different trigger types correspond to different verification input formats and contents. For the abnormal performance trigger type, the verification input includes the time series of performance metric value, the baseline reference value and the deviation threshold parameter. For the resource competition trigger type, the verification input includes the resource usage rate sequence, the competition detection parameter and the conflict identification rule. For the timing abnormality trigger type, the verification input includes the processing time sequence, the timing mode parameter and the abnormality detection algorithm configuration.

[0130] The time sequence verification calculator performs time sequence verification calculation based on the verification input, generates time sequence verification records, and the verification calculation process adopts statistical analysis methods and pattern recognition algorithms to analyze the time sequence correlation between the candidate intervention point and its downstream nodes. The calculation process includes correlation analysis, causality test, consistency verification, and abnormality degree quantification. Correlation analysis calculates the correlation strength between the metric change of the candidate intervention point and the metric change of the downstream nodes. Causality test verifies whether the change of the candidate intervention point is prior in time to the corresponding change of the downstream nodes. Consistency verification checks whether the change pattern conforms to the expected propagation rule. Abnormality degree quantification calculates the quantitative value of the change amplitude and the influence range.

[0131] The time sequence verification record includes correlation strength value, causality verification result, consistency test result, and abnormality degree quantification value. The verification result evaluator compares each index in the time sequence verification record with the preset verification threshold. When the correlation strength value is not lower than the correlation threshold, the causality verification result is positive, the consistency test result is passed, and the abnormality degree quantification value meets the significance requirement, the candidate intervention point is marked as a time sequence correlation pass state. The time sequence test statistic generator records the statistical information of the candidate intervention point that passes the test, including the test pass time, the specific value of each index, and the detailed information of the test process.

[0132] When any test condition of the candidate intervention point does not meet the requirement, the candidate intervention point is marked as a time sequence correlation fail state. For the candidate intervention point that fails the time sequence correlation test, the conflict element identifier analyzes the specific reasons and conflict points of the test failure. The conflict element includes index deviation information, inconsistent pattern, time sequence conflict, and abnormal feature. The conflict element recorder records the identified conflict elements in the time sequence test statistics in detail, and these conflict element information is used as the constraint input of the subsequent bypass verification process, guiding the parameter configuration and verification strategy selection of the bypass verification algorithm. In this way, the time sequence correlation test of the candidate intervention point has high precision and reliability, and provides accurate basic data for the subsequent verification link.

[0133] In an optional implementation, for the candidate intervention point that passes the time sequence correlation test and the bypass verification, generating a trace result and performing non-repudiable integrity packaging of the trace result and log data of the suspicious transaction includes:

[0134] Marking the candidate intervention point that passes the time sequence correlation test and the bypass verification as an important confidence intervention point, and generating an input record;

[0135] According to the input record, the log fingerprints having a causal correlation with the important confidence intervention point are extracted in chronological order to form evidence elements; the evidence elements are bound with the verification statistical quantity summary of the important confidence intervention point, sequentially concatenated into a traceability result sequence, and a result index list is generated;

[0136] The hierarchical summary calculation is performed on the traceability result sequence to generate a three-order log, and the three-order log is used as the data to be encapsulated to construct an encapsulation header; the encapsulation header is digitally signed using a controlled private key to form an integrity signature, and the integrity signature is combined with the encapsulation header to obtain an integrity encapsulation object; a verification process is performed on the integrity encapsulation object, and an anti-repudiation verification record is generated when all verifications pass.

[0137] When the candidate intervention point completes the timing correlation test and the bypass verification, the confidence evaluation module marks the intervention point that passes the verification as an important confidence intervention point. The marking process is realized through a confidence threshold comparison mechanism. Specifically, the timing correlation degree value of the intervention point is compared with a preset first threshold value, and the bypass verification result is matched with a consistency standard for verification. When the timing correlation degree value is greater than the first threshold value and the bypass verification result completely matches the consistency standard, the confidence evaluation module sets the important confidence identification bit in the intervention point data structure to a true value state.

[0138] After the marking is completed, the input record generator extracts the timestamp field, the location identification field, the verification result summary field, and the associated transaction identifier field of the intervention point, and assembles these fields into input records according to a predefined data structure format. The input record adopts a structured format of key-value pairs, each field corresponds to a unique key name and a corresponding numerical or string type value, which ensures that the required information can be accurately located and extracted by the subsequent processing module through the key name.

[0139] After receiving the input record, the log fingerprint extractor determines the start time and the end time of the analysis time window according to the timestamp information in the input record. The determination of the time window adopts a symmetric time interval centered on the timestamp of the important confidence intervention point, and each of the forward and backward is extended by a preset time length. Within the determined time window, the log fingerprint extractor performs a query operation on the log storage system to retrieve all log entries whose timestamps are located within the window range.

[0140] For each retrieved log entry, the cause-effect correlation analysis algorithm analyzes its operation type, resource identifier, user identifier, and data flow direction, and other attribute information. Cause-effect correlation determination is achieved by establishing an operation dependency graph, which takes log entries as nodes and operation dependency relationships as edges. When there is a sequence relationship of resource access, a dependency relationship of data read-write, or an association relationship of user sessions between two log entries, a directed edge is established between the corresponding nodes. Through the graph traversal algorithm, starting from the node corresponding to the important confidence intervention point, a depth-first search is performed along the directed edge to find all reachable nodes, and the log records corresponding to these nodes are the log records with cause-effect correlation.

[0141] For the identified log records with cause-effect correlation, the fingerprint calculation module extracts the content fields of each log record, including operation type, timestamp, user identifier, resource path, operation parameter, and other key information. The fingerprint calculation uses a content hash algorithm to concatenate all key information fields of the log record into a string in a fixed order, and performs hash calculation on the string to obtain a fixed-length hash value as the log fingerprint. The generated log fingerprint is mapped to the corresponding log record to form an evidence element. Each evidence element contains the content of the original log record, the corresponding log fingerprint, and the association strength value with the important confidence intervention point.

[0142] The binding operation of the evidence element and the verification statistic summary of the important confidence intervention point is achieved through the association table. The verification statistic summary includes the verification start time, the verification end time, the identifier of the verification method used, the intermediate result values in the verification process, the final verification result status, and the confidence value of the verification process. The binding process creates a record for each evidence element in the association table, which contains the unique identifier of the evidence element, the corresponding important confidence intervention point identifier, the content of the verification statistic summary, and the binding timestamp. The association table uses primary key constraints to ensure that each evidence element can only be bound to one verification statistic summary, and establishes foreign key constraints to ensure the referential integrity of the binding relationship.

[0143] After binding is complete, the sequence constructor sorts the evidence elements and verification statistic summaries in ascending order of timestamp. The sorting process uses the merge sort algorithm, taking the generation timestamp of the evidence element as the primary sorting key and the verification start time of the verification statistic summary as the secondary sorting key. After sorting, the sequence constructor concatenates the evidence elements and verification statistic summaries in the sorted order. The concatenation process uses a linked list data structure, and each element node contains a data content field, a forward pointer field pointing to the previous node, and a backward pointer field pointing to the next node. The head node of the linked list structure contains metadata information of the sequence, such as sequence length, creation time, and sequence identifier. After the sequence construction is complete, the provenance result sequence is obtained.

[0144] The index generator creates a hierarchical index structure for the provenance result sequence, the main index layer creates an index item for each significant confidence intervention point in the sequence, each index item contains a unique identifier of the intervention point, a position offset in the sequence, a number of contained evidence elements, and length information of a verification statistic digest. The auxiliary index layer creates detailed index items for each evidence element, containing an identifier of the evidence element, an absolute position in the sequence, a log fingerprint value, and a content digest of the original log record. The index structure is organized as a balanced binary tree, supporting fast lookup operations based on identifiers. After the index generation is completed, a result index manifest is formed, which is stored in the form of a separate data file, facilitating subsequent fast retrieval and positioning operations.

[0145] The hierarchical digest calculation module performs three-layer digest calculation on the provenance result sequence, the first layer of digest calculation performs element-level digest calculation on each evidence element in the sequence, the digest calculator extracts the log fingerprint, correlation strength value, and bound verification statistic identifier of the evidence element, combines these information in a fixed format, and performs hash calculation to generate an element-level digest value.

[0146] The second layer of digest calculation performs aggregation calculation on the element-level digest values of all evidence elements belonging to the same significant confidence intervention point, the aggregation process concatenates all element-level digest values into a digest string in chronological order, and performs hash calculation to generate an intervention point-level digest value. The third layer of digest calculation performs final aggregation on all intervention point-level digest values of the entire provenance result sequence, concatenates all intervention point-level digest values in the order of intervention points in the sequence, combines the metadata information of the sequence to perform final hash calculation, and generates a sequence-level digest value. The three-layer digest values are combined in hierarchical order to form a three-order log data structure containing an element-level digest set, an intervention point-level digest set, and a sequence-level digest.

[0147] The encapsulation header constructor generates the corresponding encapsulation header structure with the three-order log as the encapsulated data. The encapsulation header adopts a fixed-length binary format, containing a data type identification field, a format version number field, a generation timestamp field, a three-order log data length field, a checksum field, and a reserved extension field. The data type identification field uses a four-byte integer to identify that the encapsulated data is of the provenance result type. The format version number field uses a two-byte integer to identify the version information of the encapsulation format.

[0148] The generation timestamp field adopts an eight-byte long integer to record the creation time of the encapsulation header, the data length field adopts a four-byte integer to record the byte length of the third-order log. The checksum field adopts a four-byte integer to store the checksum value of the third-order log content. The reserved extension field reserves sixteen bytes of space for future functional extension. The encapsulation header also contains encryption-related metadata fields, such as signature algorithm identifier, hash algorithm identifier, and key version number, and the like.

[0149] The digital signature module uses a pre-configured controlled private key to perform digital signature calculation on the encapsulation header, and the private key is securely stored by the key management subsystem and physically protected by a hardware security module. The signature calculation process includes two steps: a hash value calculation step and a private key encryption step. The hash value calculation step connects all field contents of the encapsulation header into a byte array in the order of the fields, and performs a preset hash algorithm calculation on the byte array to obtain a fixed-length hash value.

[0150] The private key encryption step uses the controlled private key to perform asymmetric encryption operation on the calculated hash value to generate a digital signature value. The length of the digital signature value depends on the asymmetric encryption algorithm and the key length used. After the signature calculation is completed, the digital signature value, the signature timestamp, and the signature algorithm identifier are combined to form an integrity signature data structure.

[0151] The integrity encapsulation object constructor combines the integrity signature with the encapsulation header. The combination process creates a new data structure that includes the original encapsulation header fields, the integrity signature field, and the metadata field of the combination operation. The integrity signature field stores the integrity signature data structure generated in the foregoing step. The combination metadata field records the timestamp, operation identifier, and data integrity check information of the combination operation. The integrity encapsulation object adopts a self-describing data format, including control information for parsing and verification, such as field separator, length indicator, and data encoding format identifier. The structure design of the encapsulation object supports cross-platform parsing operations, ensuring consistent processing in different running environments.

[0152] The verification flow executor performs a multi-step verification operation on the integrity encapsulation object. The signature verification step extracts the integrity signature data from the integrity encapsulation object and uses the corresponding public key to perform verification calculation on the digital signature. The verification process includes two sub-steps: signature decryption and hash value comparison. The signature decryption sub-step uses the public key to perform decryption operation on the digital signature value to obtain the original hash value, and the hash value comparison sub-step recalculates the hash value of the encapsulation header and compares it with the decrypted hash value byte by byte.

[0153] The data integrity verification step recalculates the checksum value of the third-order log data and compares it with the checksum value stored in the encapsulation header to verify. The timestamp verification step checks the rationality of each timestamp field in the encapsulation object, including whether the generation timestamp is within a reasonable range, whether the signature timestamp is later than the generation timestamp, etc. The format verification step checks whether the data structure of the encapsulation object conforms to the pre-defined format specification, including field length, data type, field order, etc. The algorithm consistency verification step checks whether the algorithm identifier recorded in the encapsulation object is consistent with the actual algorithm used.

[0154] When the verification results of all verification steps are in the pass state, the anti-repudiation verification record generator creates the corresponding verification record. The verification record contains the verification start timestamp, the verification end timestamp, the detailed results of each verification step, the verification environment information, and the audit information of the verification operation. The verification record adopts an immutable storage format and is stored persistently using an append-only log file. The content of the verification record includes the identifier of the integrity encapsulation object, the version information of the verification algorithm, the configuration parameters of the verification environment, and the execution trajectory of the verification operation. The anti-repudiation verification record also contains archiving information for long-term preservation, such as data retention period, access permission control, and audit tracking requirements, etc. After the verification record is generated, the record is submitted to the audit subsystem through a secure channel for long-term storage and management, ensuring that the integrity protection and non-repudiation of the traceability result are effectively guaranteed.

[0155] In a second aspect of the embodiments of the present application, an embedded device domain name resolution hijacking detection and tracing system is provided, comprising:

[0156] A first unit is configured to collect all-process domain name resolution related packets of outbound and inbound in the network protocol stack of the embedded device, construct a request side record for each resolution request, construct a response side record for the received response packet, and pair them with the same transaction identifier; calculate the time delay vector, path consistency fingerprint and resolution result consistency index corresponding to the transaction identifier based on the pairing result;

[0157] A second unit is configured to determine that the transaction is suspicious when the time delay vector deviates from the confidence interval adaptively learned by the same domain name and the same interface under the same network load interval, and enter the tracing stage; and cache the path consistency fingerprint and the resolution result consistency index as tracing input evidence, so that the suspicious determination, the pairing original data and the calculation intermediate quantity have a corresponding relationship and can be cross-checked in subsequent tracing.

[0158] A third unit is configured to, in the tracing stage, construct a candidate intervention point set along a reverse sequence of a data forwarding path according to a parsed record in a suspicious transaction, and perform a timing correlation test and a bypass verification on each candidate intervention point; for a candidate intervention point passing the timing correlation test and the bypass verification, generate a tracing result, and perform non-repudiable integrity encapsulation on the tracing result and log data of the suspicious transaction.

[0159] In a third aspect, the present application provides an electronic device, comprising:

[0160] a processor;

[0161] a memory for storing processor-executable instructions;

[0162] The processor is configured to invoke the instructions stored in the memory to execute the method described above.

[0163] In a fourth aspect, the present application provides a computer-readable storage medium having stored thereon computer program instructions, which, when executed by a processor, implement the method described above.

[0164] The present application can be a method, apparatus, system and / or computer program product. The computer program product can include a computer-readable storage medium having stored thereon computer-readable program instructions that, when executed by a processor, cause the processor to execute methods according to the present application.

[0165] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. An embedded device domain name resolution hijacking detection and tracing method, characterized in that, The application comprises: Collecting all-process packets related to outbound and inbound domain name resolution in the network protocol stack of an embedded device, constructing a request-side record for each resolution request, constructing a response-side record for the received response packet, and pairing them with the same transaction identifier; Based on the pairing result, calculating the time delay vector, path consistency fingerprint, and resolution result consistency index corresponding to the transaction identifier; When the time delay vector deviates from the confidence interval adaptively learned by the same domain name and the same interface under the same network load interval, the transaction is determined to be suspicious and enters the tracing stage, which comprises: During the online transaction processing process for the target domain name and the target interface, obtaining the three-network index parameters in the request stage, and calculating the round-trip time after the transaction is completed, combining the three-network index parameters and the round-trip time to form the corresponding time delay vector; for transactions with transmission faults, consistency checking is performed based on transmission sequence integrity and confirmation number incrementality to generate a checked time delay vector sequence; Based on the occurrence time information of each transaction in the time delay vector sequence, the transaction is uniquely mapped to the corresponding network load interval; using a non-parametric density estimation method with robust loss and adaptive bandwidth, the time delay probability distribution of the target domain name and the target interface is independently generated for the time delay vector samples in each network load interval, and the time delay confidence interval of each load interval is calculated under the pre-set confidence; For the current collected transaction, construct its time delay vector, determine its corresponding current network load interval according to the occurrence time information of the transaction, and compare the time delay vector, the current network load interval, and the time delay confidence interval; when the time delay vector deviates from the corresponding time delay confidence interval, output a suspicious judgment for the transaction, and enter the tracing stage; and cache the path consistency fingerprint and the resolution result consistency index with the label of the suspicious transaction as tracing input evidence, so that the suspicious judgment, the paired original data, and the calculated intermediate quantities have a corresponding relationship and can be cross-checked in subsequent tracing; In the tracing stage, according to the resolution record in the suspicious transaction, a candidate intervention point set is constructed along the reverse sequence of the data forwarding path, and time sequence correlation test and bypass verification are performed for each candidate intervention point; for the candidate intervention point that passes the time sequence correlation test and the bypass verification, a tracing result is generated, and the tracing result and the log data of the suspicious transaction are irreversibly integrity-encapsulated.

2. The method of claim 1, wherein, For each resolution request, a request-side record is constructed, a response-side record is constructed for the received response packet, and they are paired with the same transaction identifier, which comprises: When detecting a domain name resolution request, copying the request in the sending path of the protocol stack and constructing a request-side record, and when receiving a domain name resolution response corresponding to the request, copying the response in the receiving path of the protocol stack and constructing a response-side record; pairing based on the same transaction identifier in the request-side record and the response-side record to generate a transaction record; According to the transaction record execution field level consistency check, when the field level consistency check passes, a standardized transaction record with a time sequence index is formed and written into a cyclic persistent area; when the field level consistency check fails, an abnormal transaction record is generated according to the same transaction identification, and a difference field and a time stamp difference are recorded, so as to ensure the integrity of the record and the pairing.

3. The method of claim 1, wherein, A non-parametric density estimation method with robust loss and adaptive bandwidth is used to independently generate the time delay probability distribution corresponding to the target domain name and the target interface for the time delay vector samples in each network load interval, and the time delay confidence interval of each load interval is calculated under a preset confidence level. A non-parametric density estimation method with robust loss and adaptive bandwidth is used to independently generate the time delay probability distribution corresponding to the target domain name and the target interface for the time delay vector samples in each network load interval, and the time delay confidence interval of each load interval is calculated under a preset confidence level. In the application scenario where the upper and lower boundaries of the time delay confidence interval are needed to be called, the time delay vector of the current transaction is formed and its network load interval is determined according to the same rules of data preparation and interval mapping, and the time delay confidence interval corresponding to the domain name interface network load interval and the latest effective version is read from the boundary state.

4. The method of claim 1, wherein, The path consistency fingerprint and the analysis result consistency index are cached as trace input evidence, suspicious judgment and paired original data and calculation intermediate quantity have corresponding relationship and can be cross-checked in subsequent trace. The path consistency fingerprint, the analysis result consistency index and the suspicious transaction label are bound with the same transaction identification to form trace input evidence that cannot be divided in semantics; version number and occurrence time are assigned to the trace input evidence, and ordered index items are established to identify version number, original data reference information is registered according to the explicit registration of the ordered index items, and intermediate quantity reference information is calculated; the trace input evidence and its index items are cached in the audit storage, and the cache location and index key are written back to the real-time judgment record, so that the same transaction identification can be uniquely located and consistently read; When the trace is triggered, the corresponding trace input evidence and its referenced original data and calculation intermediate quantity are retrieved according to the index key of the transaction identification version number; the path consistency fingerprint is used as the main inspection clue, and cross-checking is performed against the analysis result consistency index, when the cross-checking passes, the pass conclusion and the transaction identification version number are recorded in the audit storage; when the cross-checking fails, the inconsistent field, the corresponding time range and the involved index key are recorded, and the trace input evidence is marked as a review state.

5. The method of claim 1, wherein, In the tracing phase, a candidate intervention point set is constructed according to the resolution record in the suspicious transaction along the reverse sequence of the data forwarding path, and a time sequence correlation test and bypass verification are performed on each candidate intervention point, including: In the tracing phase, the resolution record cached for the suspicious transaction is read, and a reverse sequence of the data forwarding path is constructed in the order from the end point to the start point based on the resolution record, and a mapping entry is generated for each node in the reverse sequence; Based on the metric field vector of each mapping entry in the reverse sequence, each node is judged item by item according to a preset trigger rule, and the time window and reference index in the mapping entry are involved in the judgment to generate a candidate intervention point description; the candidate intervention point descriptions are aggregated in the order in the reverse sequence to form a candidate intervention point set with sequence identification; For each candidate intervention point in the candidate intervention point set, a metric field sequence of the candidate intervention point and its downstream nodes is extracted from the reverse sequence according to the time window and trigger type in the candidate intervention point description to construct a test input corresponding to the trigger type; a time sequence test record is calculated as a test result, when the test result is not lower than a preset test threshold, the candidate intervention point is marked as time sequence correlation passed, and a time sequence test statistic is formed; when any condition is not met, it is marked as time sequence correlation failed, and the conflict elements are recorded in the time sequence test statistic as a constraint input for bypass verification.

6. The method of claim 1, wherein, For the candidate intervention point that passes the time sequence correlation test and the bypass verification, a tracing result is generated, and the tracing result and the log data of the suspicious transaction are integrity encapsulated without repudiation, including: Marking the candidate intervention point that passes the time sequence correlation test and the bypass verification as an important confidence intervention point, and generating an input record; According to the input record, log fingerprints having a causal correlation with the important confidence intervention point are extracted in time sequence to form evidence elements; the evidence elements and the verification statistic summary of the important confidence intervention point are bound and sequentially concatenated into a tracing result sequence, and a result index list is generated; A three-order log is generated by performing hierarchical summary calculation on the tracing result sequence, and the three-order log is used as the data to be encapsulated to construct an encapsulation header; the encapsulation header is digitally signed using a controlled private key to form an integrity signature, and the integrity signature and the encapsulation header are combined to obtain an integrity encapsulation object, and a verification process is performed on the integrity encapsulation object, and an anti-repudiation verification record is generated when all verifications are passed.

7. A system for embedded device domain name resolution hijacking detection and traceback, for implementing the method of any of the preceding claims 1-6, characterized in that, Including: The first unit is configured to collect all process related packets of domain name resolution for outbound and inbound in the network protocol stack of the embedded device, construct a request side record for each resolution request, and construct a response side record for the received response packet, and pair the same transaction identifier; Based on the pairing result, a delay vector, a path consistency fingerprint and a resolution result consistency index corresponding to the transaction identifier are calculated; The second unit is configured to determine that the transaction is a suspicious transaction when the time delay vector deviates from a confidence interval obtained by self-adaptive learning of historical same-domain same-interface under the same network load interval, and enter a tracing stage; and cache the path consistency fingerprint and the resolution result consistency index and a label of the suspicious transaction as tracing input evidence, so that suspicious determination and pairing original data and calculation intermediate quantity have a corresponding relationship in subsequent tracing and can be cross-checked. The third unit is configured to construct a candidate intervention point set along a reverse sequence of a data forwarding path according to resolution records in the suspicious transaction in the tracing stage, and perform time sequence correlation verification and bypass verification on each candidate intervention point. For the candidate intervention point passing the time sequence correlation verification and the bypass verification, a tracing result is generated, and the tracing result and log data of the suspicious transaction are in irrevocable integrity encapsulation.

8. An electronic device, comprising: The computer program instructions are executed by the processor to implement the method in any one of claims 1 to 6. The computer program instructions are executed by the processor to implement the method in any one of claims 1 to 6. ​ ​ 9. A computer-readable storage medium having stored thereon computer program instructions, wherein, ​

Images