Method and system for identifying specific cdn traffic based on domain name cname record

Abstract

The application discloses a method and system for identifying specific CDN traffic based on domain name CANME records, and belongs to the technical field of traffic monitoring. The method comprises the following steps: identifying DNS traffic in internet traffic by using a traffic analysis engine, and outputting DNS CNAME type resource records; obtaining CNAME domain name records according to the output DNS CNAME type resource records, and matching the CNAME domain name records with preset platform domain name features and specific service features to obtain specific service structure data and send the specific service structure data to a CDN domain name tracking state table; updating the CDN domain name tracking state table; and according to the updated CDN domain name tracking state table, issuing IP instructions, matching IP addresses in the IP instructions with specific service traffic in target internet traffic, and obtaining CDN domain name specific internet traffic. The application can identify specific CDN platform service traffic, thereby providing guarantee for further monitoring and analysis of specific CDN traffic.

Description

Technical Field

[0001] This invention relates to the field of internet traffic monitoring technology, and more specifically to a method and system for identifying specific CDN traffic based on domain name CNAME records. Background Technology

[0002] In the field of internet traffic monitoring and analysis, static rules are generally used for traffic filtering. However, the identification, analysis and filtering of internet traffic for specific businesses or scenarios face the problem of lacking obvious static features or having certain features but not being comprehensive. This is especially true for traffic identification and filtering for CDN platform services, where the role of static features has significantly decreased under the trend of traffic encryption.

[0003] Therefore, identifying the traffic of specific CDN platform services is a problem that urgently needs to be solved in this field. Summary of the Invention

[0004] In view of this, the present invention provides a method and system for identifying specific CDN traffic based on domain name CNAME records.

[0005] To achieve the above objectives, the present invention adopts the following technical solution:

[0006] This invention first discloses a method for identifying specific CDN traffic based on domain name CNAME records, including the following steps:

[0007] S1. Resolve the DNS traffic in the target Internet traffic, filter out the DNS recursive request and response traffic with CNAME records as valid traffic, and resolve the valid traffic to output DNS CNAME type resource records;

[0008] S2. Obtain the CNAME domain name record based on the output DNS CNAME type resource record, and match it with the preset platform domain name characteristics and specific business characteristics to obtain specific business structure data and send it to the CDN domain name tracking status table;

[0009] S3. Based on the identified specific business structure data, update the CNAME alias domain status information in the CDN domain tracking status table, as well as the traffic matching engine status information;

[0010] S4. Based on the updated CDN domain name tracking status table, issue an IP instruction and use the IP address in the IP instruction to match the specific service traffic in the target Internet traffic to obtain the specific Internet traffic of the CDN domain name, wherein the specific service traffic includes HTTP service traffic or HTTPS service traffic.

[0011] Furthermore, in S1, the DNS CNAME type resource record includes the requested domain name, CNAME domain name record, associated IP address record, and TTL lifecycle information;

[0012] The CNAME domain record includes at least one CNAME alias domain record.

[0013] Furthermore, S2 specifically includes:

[0014] S21: CNAME Domain Record Organization:

[0015] Obtain the CNAME domain name record from the DNS CNAME type resource record;

[0016] The obtained CNAME domain records are sequentially deduplicated and segmented to obtain the corresponding domain data set and business data set;

[0017] S22: Traverse the second-level domain records in the domain data set and match them sequentially with the preset platform domain feature database. If the second-level domain in the domain data set matches the second-level domain in the platform domain feature database, proceed to step S23. If no match is found, proceed to the next DNS request response resolution.

[0018] S23: Traverse the word segmentation records of the business data set and perform multi-mode matching with the preset business feature library in turn. If the word sequence after word segmentation in the business data set matches the word sequence in the business feature library, generate a specific CDN identification ID and generate specific business structure data by combining it with the associated DNS CNAME type resource record data. Then proceed to step S24. Otherwise, perform matching on the next word segmentation record.

[0019] S24: Send specific business structure data to the CDN domain name tracking status table. The specific business structure data includes key CNAME alias domains, specific CDN identification IDs, CNAME domain records, associated IP address records, and TTL lifecycle information. The key CNAME alias domain is the last CNAME alias domain in the CNAME domain record.

[0020] Further, in step S21, the obtained CNAME domain records are sequentially deduplicated and segmented to obtain the corresponding domain data set and business data set, specifically including:

[0021] For the first CNAME record, remove any data content that is duplicated with the requested domain name string;

[0022] Extract the CNAME subdomain from the data after removing the request domain string and store it in the domain data collection structure;

[0023] The string after the CNAME second-level domain name is segmented using dots and hyphens, and the segmented word sequence is stored sequentially into the business data collection structure.

[0024] For records other than the first CNAME record, extract the second-level domains sequentially and store them in the domain dataset structure;

[0025] The string after the second-level domain name is extracted from the non-first CNAME domain record and processed by word segmentation using dots and hyphens. The word sequence after segmentation is stored in the business dataset structure.

[0026] After sorting, the domain data set and business data set of the CNAME domain records are obtained.

[0027] Further, in step S23, the word sequence after word segmentation in the business data set is matched with the word sequence in the business feature library, specifically including:

[0028] The word sequence after word segmentation in the business data set is compared with the word sequence in the business feature library. If any one of the three features—preceding wildcard feature, subsequent wildcard feature, and exact matching feature—matches successfully, the business data is successfully identified, i.e., a match is hit.

[0029] Furthermore, S3 specifically includes:

[0030] S31: Use the CDN domain tracking status table to look up the CNAME alias domain entry:

[0031] If a CNAME alias domain entry is found in the CDN domain tracking status table, the differences between the associated IP address record in the specific business structure data and the associated IP address record in the CNAME alias domain entry are compared, and step S32 is executed.

[0032] If no CNAME alias domain entry is found in the CDN domain tracking status table, proceed to step S33;

[0033] S32: If the IP address record associated in the specific business structure data is the same as the IP address associated in the table entry, then update the TTL lifetime of the corresponding IP address in the corresponding table entry of the tracking status table, and at the same time issue an IP time update instruction to the traffic matching engine.

[0034] If the IP address associated in the CNAME record structure data is different from the IP address associated in the CNAME alias domain name table, then add the corresponding IP address record in the CDN domain tracking status table, and simultaneously issue an IP addition instruction to the traffic matching engine;

[0035] S33: Add a new CDN domain tracking status table entry indexed by the key CNAME alias domain to the CDN domain tracking status table, and populate the key CNAME alias domain, associated IP address record, and TTL time-to-live field. At the same time, issue an IP addition instruction corresponding to all associated IP address records to the traffic matching engine.

[0036] S34: Periodically traverse the CDN domain name tracking status table, reduce the TTL lifetime of each entry in the CDN domain name tracking status table by the periodic interval. If the TTL lifetime is less than 0, the entry will age out and an IP deletion command will be generated based on the IP address in the entry. This command will be sent to the traffic matching engine, and then the entry will be deleted.

[0037] Furthermore, in S4, the IP address in the IP instruction is matched with specific service traffic in the target Internet traffic to obtain the specific Internet traffic of the CDN domain name, specifically including:

[0038] The traffic matching engine receives IP instructions from the CDN domain tracking status table in real time;

[0039] If the IP instruction issued by the CDN domain tracking status table is an IP deletion instruction, then the corresponding IP rule in the traffic matching engine will be deleted.

[0040] If the IP instruction issued by the CDN domain tracking status table is an IP update instruction or an IP addition instruction, the IP address in the IP update instruction or IP addition instruction will be matched with the IP address of the specific business traffic in the target Internet traffic. If the match is successful, the specific business traffic in the target Internet traffic is the CDN domain's specific Internet access traffic.

[0041] In another aspect, the present invention discloses a system for identifying specific CDN traffic based on domain name CNAME records, including a computer system, wherein the computer system, when executed, is capable of implementing the method for identifying specific CDN traffic based on domain name CNAME records as described in any one of the present invention.

[0042] As can be seen from the above technical solution, compared with the prior art, the present invention discloses a method and system for identifying specific CDN traffic based on domain name CNAME records, which has the following beneficial effects:

[0043] This invention primarily addresses the characteristic of CDN platform services relying on DNS as the acceleration entry point. By summarizing the principles of existing CDN acceleration services, it uses CDN domain name segmentation to identify traffic components by including business features, and categorizes traffic into platform service traffic categories by associating IP tags. By identifying and real-time associating the IP features of specific CDN traffic with specific CDN domain names, it can dynamically update CDN traffic identification and filtering rules, thereby providing assurance for further monitoring and analysis of specific CDN platform service traffic. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0045] Figure 1 This is a schematic diagram of the overall process of the method provided by the present invention.

[0046] Figure 2 A flowchart illustrating the method execution steps provided in this embodiment of the invention. Detailed Implementation

[0047] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0048] This invention discloses a method for identifying specific CDN traffic based on domain name CNAME records. By summarizing the principles of existing CDN acceleration services, it uses CDN domain name segmentation to include business characteristics to identify traffic components, and categorizes the traffic into major CDN platform business traffic categories by associating IP tags. The method comprises two core parts: DNS traffic CNAME record resolution and extraction, and specific business CDN domain name feature identification.

[0049] The DNS traffic CNAME record resolution and extraction process involves a traffic resolution engine identifying DNS traffic within internet traffic, filtering and selecting DNS recursive request-response traffic with CNAME records as valid traffic for resolution and reconstruction, and outputting DNS CNAME type resource record resolution result data. The CNAME resolution result data includes information such as the requested domain name, recursive identifier, CNAME domain record, associated IP address record, and TTL (Time To Live).

[0050] Specific business CDN domain name characteristics are identified, and then the CNAME domain name records in the DNS CNAME type resource records are organized. At this time, the CNAME domain name records store the hierarchical domain name and domain name mapping relationship, which needs to be deduplicated and segmented to form structured data for subsequent processing.

[0051] refer to Figure 1 , Figure 2 The method for identifying specific CDN traffic based on domain name CNAME records in this embodiment of the invention specifically includes the following steps:

[0052] Step 1: CNAME domain record organization. Remove duplicate content from the first CNAME domain record that is identical to the requested domain string to avoid interference with subsequent domain analysis on the CDN platform. Then, extract the CNAME subdomain and store it in the domain data set structure. The remaining domain string is segmented using periods (.) and hyphens (-). The resulting word sequences are then stored in the business data set structure. For other CNAME domain records, extract the subdomains and store them in the domain data set structure. Then, the remaining domain string is segmented using periods (.) and hyphens (-). The resulting word sequences are then stored in the business data set structure. This process yields the domain data set and business data set for the CNAME resolution results.

[0053] Step 2: Traverse the second-level domain records in the domain data set and perform precise matching with the platform's domain feature database in turn. If a match is found, proceed to the next step of analysis; otherwise, proceed to the next DNS request response analysis.

[0054] Step 3: Traverse the word segmentation records in the business data set and perform multi-modal matching with the business feature library in turn. If the multi-modal matching is successful, the word is further compared with the feature. Words that meet any of the three features of front wildcard feature, back wildcard feature, and exact match feature are recorded as successful business recognition, and specific business record structure data is generated. Then proceed to the next step of processing. Otherwise, the next word segmentation record is matched.

[0055] Step 4: The specific business record structure data includes information such as the tracking CNAME alias domain, specific CDN identification ID, CNAME domain record, associated IP address record, and TTL lifecycle, and is then sent to the CDN domain tracking status table for processing. The tracking CNAME alias domain is the identifier field of the specific business record structure data. The CNAME domain record contains one or more CNAME alias domains, and the last CNAME alias domain is the domain name of the node server where the actual content is distributed after CDN load balancing. The last CNAME alias domain name is selected as the tracking CNAME alias domain and used as the identifier field of the business record structure data.

[0056] 3. CDN Domain Name Tracking Processing

[0057] The system receives specific business record structure data in real time, finds the corresponding entry in the CDN domain tracking status table by tracking alias domains, updates the latest status information of the CNAME alias domains in the CDN domain tracking status table, and updates the status information of the traffic matching engine.

[0058] Step 1: Search for the CNAME alias domain entry in the CDN domain tracking status table. If a corresponding entry is found, compare the associated IP address record in the CNAME record structure data with the associated IP address record in the entry. If the IP addresses are the same, update the TTL (Time To Live) of the corresponding IP address in the entry and send an IP time update command to the traffic matching engine. If the IP addresses are different, add a new IP address record to the entry and send an IP add command to the traffic matching engine.

[0059] Step 2: If no corresponding entry is found in the CDN domain tracking status table, a new CDN domain tracking status entry is added with the key CNAME alias domain as the index. The key CNAME alias domain, associated IP address record, TTL time to live, and other fields are populated. At the same time, an IP addition instruction corresponding to all IP address records is sent to the traffic matching engine.

[0060] Step 3: Periodically traverse the CDN domain tracking status table, reduce the TTL (Time To Live) of each IP address in the table entry by the periodic interval. If the TTL is less than 0, age the corresponding record of the IP address and send an IP deletion command to the traffic matching engine.

[0061] 4. Matching internet traffic to specific CDN domains

[0062] The traffic matching engine receives IP commands from the CDN domain tracking status table in real time. If it's an IP deletion command, the corresponding IP rule is deleted from the traffic matching engine. If it's an IP update or addition command, the traffic matching engine identifies the traffic as CDN domain internet traffic when the IP rule containing the IP command characteristics matches the traffic's IP field value. Further operations such as forwarding, retention, and monitoring analysis can be performed on the tracked traffic.

[0063] The present invention also discloses a computer system that, when executed, can implement the method for identifying specific CDN traffic based on domain name CNAME records as described in any one of the present invention.

[0064] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0065] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for identifying specific CDN traffic based on domain name CNAME records, characterized in that, Includes the following steps: S1. Resolve the DNS traffic in the target Internet traffic, filter out the DNS recursive request and response traffic with CNAME records as valid traffic, and resolve the valid traffic to output DNS CNAME type resource records; S2. Obtain the CNAME domain name record based on the output DNS CNAME type resource record, and match it with the preset platform domain name characteristics and specific business characteristics to obtain specific business structure data and send it to the CDN domain name tracking status table; S3. Based on the identified specific business structure data, update the CNAME alias domain status information in the CDN domain tracking status table, as well as the traffic matching engine status information; specifically including: S31: Use the CDN domain tracking status table to look up CNAME alias domain entries: If a CNAME alias domain entry is found in the CDN domain tracking status table, the differences between the associated IP address record in the specific business structure data and the associated IP address record in the CNAME alias domain entry are compared, and step S32 is executed. If no CNAME alias domain entry is found in the CDN domain tracking status table, proceed to step S33; S32: If the IP address record associated in the specific business structure data is the same as the IP address associated in the table entry, then update the TTL lifetime of the corresponding IP address in the corresponding table entry of the tracking status table, and at the same time issue an IP time update instruction to the traffic matching engine. If the IP address associated in the CNAME record structure data is different from the IP address associated in the CNAME alias domain name table, then add the corresponding IP address record in the CDN domain tracking status table, and simultaneously issue an IP addition instruction to the traffic matching engine; S33: Add a new CDN domain tracking status table entry indexed by the key CNAME alias domain to the CDN domain tracking status table, and populate the key CNAME alias domain, associated IP address record, and TTL time-to-live field. At the same time, issue an IP addition instruction corresponding to all associated IP address records to the traffic matching engine. S34: Periodically traverse the CDN domain name tracking status table, reduce the TTL lifetime of each entry in the CDN domain name tracking status table by the periodic interval. If the TTL lifetime is less than 0, the entry will age out and an IP deletion command will be generated based on the IP address in the entry. This command will be sent to the traffic matching engine and the entry will be deleted. S4. Based on the updated CDN domain name tracking status table, issue an IP instruction and use the IP address in the IP instruction to match the specific service traffic in the target Internet traffic to obtain the specific Internet traffic of the CDN domain name, wherein the specific service traffic includes HTTP service traffic or HTTPS service traffic.

2. The method for identifying specific CDN traffic based on domain name CNAME records according to claim 1, characterized in that, In S1, the DNS CNAME type resource record includes the requested domain name, CNAME domain name record, associated IP address record, and TTL lifecycle information; The CNAME domain record includes at least one CNAME alias domain record.

3. The method for identifying specific CDN traffic based on domain name CNAME records according to claim 1, characterized in that, S2 specifically includes: S21: CNAME Domain Record Organization: Obtain the CNAME domain name record from the DNS CNAME type resource record; The obtained CNAME domain records are sequentially deduplicated and segmented to obtain the corresponding domain data set and business data set; S22: Traverse the second-level domain records in the domain data set and match them sequentially with the preset platform domain feature database. If the second-level domain in the domain data set matches the second-level domain in the platform domain feature database, proceed to step S23. If no match is found, proceed to the next DNS request response resolution. S23: Traverse the word segmentation records of the business data set and perform multi-mode matching with the preset business feature library in turn. If the word sequence after word segmentation in the business data set matches the word sequence in the business feature library, generate a specific CDN identification ID and generate specific business structure data by combining it with the associated DNS CNAME type resource record data. Then proceed to step S24. Otherwise, perform matching on the next word segmentation record. S24: Send specific business structure data to the CDN domain name tracking status table. The specific business structure data includes key CNAME alias domains, specific CDN identification IDs, CNAME domain records, associated IP address records, and TTL lifecycle information. The key CNAME alias domain is the last CNAME alias domain in the CNAME domain record.

4. The method for identifying specific CDN traffic based on domain name CNAME records according to claim 3, characterized in that, In step S21, the obtained CNAME domain records are sequentially deduplicated and segmented to obtain the corresponding domain data set and business data set, specifically including: For the first CNAME record, remove any data content that is duplicated with the requested domain name string; Extract the CNAME subdomain from the data after removing the request domain string and store it in the domain data collection structure; The string after the CNAME second-level domain name is segmented using dots and hyphens, and the segmented word sequence is stored sequentially into the business data collection structure. For records other than the first CNAME record, extract the second-level domains sequentially and store them in the domain dataset structure; The string after the second-level domain name is extracted from the non-first CNAME domain record and processed by word segmentation using dots and hyphens. The word sequence after segmentation is stored in the business dataset structure. After sorting, the domain data set and business data set of the CNAME domain records are obtained.

5. The method for identifying specific CDN traffic based on domain name CNAME records according to claim 3, characterized in that, In step S23, the word sequence after word segmentation in the business data set matches the word sequence in the business feature library, specifically including: The word sequence after word segmentation in the business data set is compared with the word sequence in the business feature library. If any one of the three features—preceding wildcard feature, subsequent wildcard feature, and exact matching feature—matches successfully, the business data is successfully identified, i.e., a match is hit.

6. The method for identifying specific CDN traffic based on domain name CNAME records according to claim 1, characterized in that, In S4, the IP address in the IP instruction is matched with specific service traffic in the target Internet traffic to obtain the specific Internet traffic of the CDN domain name, specifically including: The traffic matching engine receives IP instructions from the CDN domain tracking status table in real time; If the IP instruction issued by the CDN domain tracking status table is an IP deletion instruction, then the corresponding IP rule in the traffic matching engine will be deleted. If the IP instruction issued by the CDN domain tracking status table is an IP update instruction or an IP addition instruction, the IP address in the IP update instruction or IP addition instruction will be matched with the IP address of the specific business traffic in the target Internet traffic. If the match is successful, the specific business traffic in the target Internet traffic is the CDN domain's specific Internet access traffic.

Images