Method and system for evaluating recursive DNS service quality based on log analysis

Abstract

The invention relates to a method and system for evaluating recursive DNS service quality based on log analysis, and the method comprises the steps: collecting log data of recursive DNS nodes, extracting and preprocessing recursive query related fields, and forming a structured analysis data set; performing multi-dimensional service quality analysis based on the analysis data set to generate a statistical index; constructing a behavior link model of the recursive query based on the recursive query related field; and positioning the root cause of the abnormal service quality and generating an abnormal report through the cross analysis statistical index and the behavior link model. According to the invention, through full-amount log collection and multi-dimensional analysis, recursive DNS analysis behaviors are fully covered, and the defects of limited coverage range and rough granularity of a traditional dial testing method are overcome; the root cause with abnormal service quality is accurately positioned through behavior link reduction and systematized root cause positioning logic, so that the problem of failure or delay of analysis without traceability in the prior art is solved; and by adopting quantile statistics, the tail delay is accurately captured, and the accuracy and the real-time performance of evaluation are improved.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of domain name system, and particularly relates to a method and system for evaluating the quality of service of recursive DNS based on log analysis. BACKGROUND

[0002] With the rapid development of the Internet and communication technology, the domain name system (DNS) as the core infrastructure of network communication has an important influence on user access experience. DNS resolution success rate and response time are key indicators for evaluating the quality of local DNS service, and the industry has carried out extensive optimization. However, the existing technology mainly focuses on the optimization of the link from the user terminal to the local DNS (LDNS), and lacks effective identification and analysis means for recursive DNS resolution failure or delay problems, which limits the improvement of service quality. At present, the recursive DNS resolution process usually lacks detailed records and presents a "black box" state, making it difficult to accurately trace the resolution behavior, performance anomalies or failure causes, which restricts the diagnosis and optimization work. The existing technology mainly relies on active dialing test methods, which sample test specific domain names through preset probe points, but the data coverage is limited, the analysis granularity is rough, and the real-time performance is insufficient.

[0003] A Chinese patent CN112104498A discloses a DNS spoofing attack detection method based on a cloud platform, which collects data through hierarchical dialing, but relies on external probing and fails to use the native data of the recursive process. Another Chinese patent CN114500252B monitors the DNS service status by issuing a probing task under the Anycast node, but still takes sample dialing as the core, and the evaluation range is limited to the Anycast architecture, which lacks universality.

[0004] Therefore, the existing dialing method cannot cover all recursive resolution requests, and it is difficult to restore the complete recursive query link, so it is difficult to accurately locate the root cause of the performance anomaly or failure, which limits the comprehensive evaluation and optimization capability of the quality of recursive DNS service. SUMMARY

[0005] The purpose of the present application is to provide a method and system for evaluating the quality of service of recursive DNS based on log analysis, to solve the technical problems of incomplete coverage, insufficient granularity and limited problem positioning capability in the prior art.

[0006] To achieve one of the above-mentioned purposes, an embodiment of the present application provides a method for evaluating the quality of service of recursive DNS based on log analysis, the method comprising,

[0007] Collecting log data of recursive DNS nodes, extracting recursive query related fields and preprocessing to form a structured analysis data set;

[0008] Perform multi-dimensional service quality analysis based on the analysis dataset to generate statistical indicators;

[0009] Construct a behavior link model of recursive query based on the recursive query related fields;

[0010] By cross-analyzing the statistical indicators and the behavior link model, the root cause of the service quality anomaly is located and an anomaly report is generated.

[0011] As a further improvement of an embodiment of the application, the method further comprises collecting log data of the recursive DNS node, extracting recursive query related fields and preprocessing, including,

[0012] Obtain full-quantity request and response logs by continuously monitoring port 53, extract timestamp, client IP, query domain name, query type, response code, response time and authoritative DNS server IP;

[0013] The preprocessing includes filtering log records with format errors or incompleteness, aligning the timestamp, standardizing the numerical field of the response time, and normalizing the query domain name to the effective top-level domain plus one-level domain name for aggregate analysis, and retaining the original query domain name for micro-analysis.

[0014] As a further improvement of an embodiment of the application, the method further comprises performing multi-dimensional service quality analysis based on the analysis dataset to generate statistical indicators, including,

[0015] Grouping by authoritative DNS server IP as the primary key, statistics of total recursion times, success rate of response code NOERROR, error rate of response code SERVFAIL, error rate of response code NXDOMAIN, and P50, P95 and P99 percentile values of response time;

[0016] Grouping by the normalized domain name as the primary key, and can drill down to the complete query domain name, statistics of the total recursion times, success rate, error rate, NXDOMAIN rate, and P50, P95, P99 percentile values, and comparison of service quality differences of the same domain name on multiple NS servers.

[0017] As a further improvement of an embodiment of the application, the method further comprises performing multi-dimensional service quality analysis based on the analysis dataset to generate statistical indicators, including,

[0018] Perform reverse PTR record query on the authoritative DNS server IP to obtain NS name;

[0019] Resolve the ownership information of the authoritative DNS server IP through WHOIS query or pre-set IP database, for identifying the operation subject of the abnormal node;

[0020] According to the DNS response flag bit marking whether the authoritative DNS server IP is a legal authorized server, abnormal root cause positioning is assisted.

[0021] As a further improvement of an embodiment of the application, the method further comprises that the behavior link model of the recursive query is constructed based on the recursive query related fields, including,

[0022] Based on the timestamps, query domain names, client IPs, authoritative DNS server IPs, NS names and response codes in the preprocessed logs, a query path is formed in timestamp order.

[0023] Based on the query path and NS names, the interaction links of multiple authoritative DNS servers involved in the recursive query process are reconstructed, and the authorization state of each server is marked for visualizing the abnormal query path.

[0024] As a further improvement of an embodiment of the application, the method further comprises that the root cause of the positioning service quality anomaly includes,

[0025] When multiple domain names appear to have a decrease in success rate of resolution or P95 / P99 response time delay exceeding a preset threshold on the same authoritative DNS server IP, it is identified that the authoritative DNS server is faulty.

[0026] When a single domain name appears to have resolution anomalies on multiple authoritative DNS server IPs, it is identified that the domain name configuration is incorrect or the TTL setting is improper.

[0027] When the anomaly is concentrated in a specific time period, it is identified that the recursive DNS node or the egress network is faulty.

[0028] When the anomaly time distribution is dispersed, it is identified that the network is hijacked or the DNS is polluted.

[0029] When the failure rate of a specific query type is significantly high, it is identified that the operation strategy limit, record missing or security blocking policy is effective.

[0030] As a further improvement of an embodiment of the application, the method further comprises that the generation of the anomaly report includes,

[0031] Based on the root cause positioning result, the IP address, attribution information and affected domain name list of the abnormal authoritative DNS server are output.

[0032] Based on the statistical indicators, the domain name ranking of poor service quality is generated in order of resolution failure rate or P95 / P99 response time delay.

[0033] Based on the root cause positioning result, the time period and frequency of the abnormal resolution behavior are counted, and the anomaly report is generated.

[0034] To achieve the above-mentioned one of the purposes of the application, an embodiment of the application further provides a system for evaluating the quality of recursive DNS service based on log analysis, the system comprising a log collection module, an analysis module, a behavior link construction module and a root cause positioning module.

[0035] The log collection module is configured to collect log data of the recursive DNS node, extract recursive query related fields and perform preprocessing to form a structured analysis data set.

[0036] The analysis module is configured to perform multi-dimensional quality of service analysis based on the analysis data set and generate statistical indicators.

[0037] The behavior link construction module is configured to construct a behavior link model of recursive query based on the recursive query related fields.

[0038] The root cause positioning module is configured to cross-analyze the statistical indicators and the behavior link model to locate the root cause of the quality of service anomaly and generate an anomaly report.

[0039] To achieve the above-mentioned one of the purposes of the application, an embodiment of the application further provides an electronic device comprising a memory and a processor, characterized in that the memory stores a computer program executable on the processor, and the processor executes the program to implement the steps of the method for dynamically announcing heterogeneous computing resource based on BGP extension as described above.

[0040] To achieve the above-mentioned one of the purposes of the application, an embodiment of the application further provides a storage medium storing a computer program, characterized in that the computer program is executed by a processor to implement the steps of the method for dynamically announcing heterogeneous computing resource based on BGP extension as described above.

[0041] Compared with the prior art, the method and system for evaluating the quality of recursive DNS service based on log analysis provided by the application comprehensively cover recursive DNS resolution behavior through full log collection and multi-dimensional analysis, overcoming the defects of limited coverage and coarse granularity of traditional probing methods; through behavior link restoration and systematic root cause positioning logic, the root cause of the quality of service anomaly is accurately located, solving the problem that the prior art cannot trace and analyze failure or delay; by using the quantile value statistical method, tail delay is accurately captured, improving the accuracy and real-time performance of the evaluation, and providing an operable guide for DNS service optimization. BRIEF DESCRIPTION OF DRAWINGS

[0042] Figure 1 is the overall flowchart of the method for evaluating the quality of recursive DNS service based on log analysis provided by the application.

[0043] Figure 2is a dimension analysis business process schematic diagram of the method for evaluating recursive DNS service quality based on log analysis.

[0044] Figure 3 is a fault location business process flow schematic diagram of the method for evaluating recursive DNS service quality based on log analysis.

[0045] Figure 4 is an architecture schematic diagram of the system for evaluating recursive DNS service quality based on log analysis. DETAILED DESCRIPTION

[0046] The application will be described in detail below with reference to the specific embodiments shown in the drawings. However, these embodiments do not limit the application, and the structural, method, or functional changes made by those of ordinary skill in the art based on these embodiments are included in the protection scope of the application.

[0047] The embodiments of the application are described in detail below, and examples of the embodiments are shown in the drawings, in which the same or similar reference numerals represent the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the drawings are exemplary and are only used to explain the application and cannot be understood as a limitation of the application.

[0048] In the first embodiment of the application, the application provides a method for evaluating recursive DNS service quality based on log analysis, as shown in Figure 1 The method comprises,

[0049] S1: Collecting log data of a recursive DNS node, extracting recursive query related fields and performing preprocessing to form a structured analysis data set;

[0050] S2: Performing multi-dimensional service quality analysis based on the analysis data set to generate statistical indicators;

[0051] S3: Constructing a behavior link model of recursive queries based on the recursive query related fields;

[0052] S4: Locating the root cause of service quality anomalies and generating an anomaly report by cross-analyzing the statistical indicators and the behavior link model.

[0053] In one specific embodiment of the application, the log data of the recursive DNS node is collected, the recursive query related fields are extracted and preprocessed, specifically,

[0054] The full-quantity request and response logs are obtained by continuously monitoring the 53 port, and the timestamp, client IP, query domain name, query type, response code, response time, and authoritative DNS server IP are extracted;

[0055] The preprocessing includes filtering format error or incomplete log records, aligning time stamps, standardizing numerical fields of response time, and normalizing query domain names to valid top-level domains plus one-level domain names for aggregate analysis, and retaining original query domain names for micro-analysis.

[0056] It should be noted that collecting log data of recursive DNS nodes is achieved by deploying a traffic capture module on the recursive DNS device side, continuously monitoring port 53, obtaining full request and response logs, to ensure coverage of all recursive DNS query behaviors and provide comprehensive analysis data basis.

[0057] Further, the collected log data includes complete records of each recursive query, and the extracted key fields include: timestamp: records the specific time of request or response, used for time series analysis and behavior link restoration; client IP: identifies the client address initiating the query, used for analyzing user request source and distribution; query domain name: records the domain name requested by the user for resolution, supporting domain name dimension analysis; query type: identifies the record type of DNS query (such as A, AAAA, CNAME, etc.), used to identify performance problems of specific query types; response code: records the status code of DNS response (such as NOERROR, SERVFAIL, NXDOMAIN, etc.), used to evaluate resolution success rate and error type; response time: records the time interval from request initiation to response reception, used to calculate latency indicators; authoritative DNS server IP: records the destination authoritative DNS server address involved in recursive query, used for authoritative DNS dimension analysis.

[0058] Through full log collection, this method can capture all query requests and response data processed by recursive DNS nodes, significantly improving the comprehensiveness and representativeness of data coverage compared to traditional sampling probing methods, providing a reliable data basis for subsequent multi-dimensional analysis and problem positioning.

[0059] Further, the preprocessing process aims to transform raw log data into structured and analyzable data sets, ensuring data quality and analysis accuracy. The specific preprocessing steps include:

[0060] Filtering format error or incomplete log records: by checking the integrity and field format of log records, filter out records missing key fields (such as timestamps, response codes) or format errors (such as non-standard DNS protocol data), to eliminate the interference of invalid data on analysis results.

[0061] Time stamp alignment: calibrate the time stamps in the log, unify the time format and align to the same time reference (such as UTC), to ensure the accuracy of time series analysis, especially when processing logs in a multi-node distributed environment, to eliminate the influence of time deviation.

[0062] Response time normalization: The response time field is normalized to unify the time unit (e.g., milliseconds) and filter or correct abnormal values (e.g., negative values or excessively large delays) to ensure the numerical consistency and reliability of subsequent statistical analysis.

[0063] Query domain normalization and reservation: To support multi-granularity analysis, the query domain name is normalized to the effective top-level domain plus one-level domain name (e.g., www.sub.domain.com and api.sub.domain.com are normalized to domain.com), which is used for aggregated analysis of the domain dimension to evaluate the overall domain resolution performance; at the same time, the original query domain name (e.g., www.sub.domain.com) is reserved for micro-analysis of the precise domain level to identify the service quality problems of sub-domains or specific domain names.

[0064] In one specific embodiment of the present application, multi-dimensional service quality analysis is performed based on the analysis dataset to generate statistical indicators, specifically,

[0065] Grouping by authoritative DNS server IP as the primary key, the total recursion number, success rate of response code NOERROR, error rate of response code SERVFAIL, error rate of response code NXDOMAIN, and P50, P95, and P99 quantile values of response time are counted.

[0066] Grouping by the normalized domain name as the primary key and drilling down to the complete query domain name, the total recursion number, success rate, error rate, NXDOMAIN rate, and P50, P95, and P99 quantile values are counted, and the service quality differences of the same domain name on multiple NS servers are compared.

[0067] It should be noted that the multi-dimensional service quality analysis based on the analysis dataset aims to generate comprehensive and refined service quality indicators by performing statistical analysis of the authoritative DNS server IP dimension and domain / domain name dimension on the preprocessed recursive DNS log data, to evaluate the reliability, response capability, and stability of the recursive DNS service. The analysis process is based on structured analysis dataset, using authoritative DNS server IP and normalized domain name as grouping keys, quantifying service performance from macro and micro perspectives respectively, and accurately capturing tail delay problems through quantile value statistical method, providing quantitative basis for subsequent problem positioning and optimization.

[0068] Further, as Figure 2As shown, the authoritative DNS server IP dimension analysis groups by the authoritative DNS server IP as the primary key, and calculates the following key indicators: Total recursion times: Calculate the total number of times each authoritative DNS server IP is queried in the log data, reflecting the influence weight of the server in recursive query, used to evaluate its service load and importance. Success rate: Calculate the proportion of requests with response code NOERROR, i.e. the number of successful resolution requests divided by the total recursion times, used to measure the resolution reliability of the authoritative DNS server. Error rate: Calculate the proportion of requests with response code SERVFAIL, reflecting the frequency of authoritative DNS server end failure or processing error, which is a key indicator for evaluating service stability. NXDOMAIN rate: Calculate the proportion of requests with response code NXDOMAIN, identifying the proportion of non-existent domain name queries, used to detect garbage domain name registration, spelling errors or global configuration problems. Response time quantile value: Perform quantile value statistics on response time, calculate P50 (median, reflecting the typical experience of 50% requests), P95 (95th quantile, reflecting the upper limit of most slow requests) and P99 (99th quantile, capturing 1% of extreme delay), to overcome the sensitivity of average value to abnormal value and accurately evaluate the tail delay performance.

[0069] Through the analysis of authoritative DNS server IP dimension, this method can identify the performance differences of each authoritative server, quantify its influence on the quality of recursive DNS service, and provide key evidence for problem root cause positioning. For example, if the SERVFAIL error rate of a certain authoritative DNS server IP is significantly higher, it may indicate that the server has a fault or configuration problem.

[0070] Further, as Figure 2As shown, the domain and domain name dimension analysis is grouped by the normalized domain name (valid top-level domain plus one-level domain name, such as domain.com) as the primary key, and supports drilling down to the complete query domain name (such as www.sub.domain.com), and statistics of the same indicators as the authoritative DNS server IP dimension: total recursion times, success rate, error rate, NXDOMAIN rate, and P50, P95, P99 response time quantile values. The specific analysis content includes: total recursion times: statistics of the request times of each domain or complete query domain name, reflecting its parsing popularity, used to evaluate the business importance of the domain. Success rate, error rate, NXDOMAIN rate: calculate the proportion of requests with Rcode = NOERROR, SERVFAIL and NXDOMAIN, respectively, used to evaluate the parsing reliability and abnormal conditions (such as spelling errors or abandoned domain names) of the domain or domain name. Response time quantile value: calculate P50, P95 and P99 quantile values, accurately capture the typical and tail delay performance of the domain or domain name in the parsing process. NS server service quality difference comparison: for the same domain or domain name, analyze the service quality index differences of multiple NS servers (corresponding to different authoritative DNS server IPs), such as the fluctuation of success rate or latency, used to identify performance bottlenecks or configuration problems of specific NS servers.

[0071] Through the analysis of the domain and domain name dimensions, the method can evaluate the parsing quality from the macro (domain level) and micro (complete query domain name level) two levels, and reveal the performance differences of the same domain name on different authoritative DNS servers. For example, if the P99 latency of a domain on a certain NS server is significantly higher than that on other servers, it can be preliminarily inferred that there is a performance problem with the server.

[0072] Preferably, the statistical indicators generated by the above analysis are stored in a time series database in time series form, supporting real-time monitoring and historical data tracing. The indicators of the authoritative DNS server IP dimension are used to identify server-level performance problems, and the indicators of the domain and domain name dimensions are used to evaluate the parsing performance of specific domains or domain names, and the combination of the two provides a comprehensive quantitative basis for subsequent behavior link restoration and problem root cause positioning. In addition, by comparing the service quality differences of the same domain name on multiple NS servers, the method can further assist in locating the specific link where the anomaly occurs, such as authoritative DNS server failure, domain name configuration error or network link problem.

[0073] In one specific embodiment of the present application, the multi-dimensional service quality analysis based on the analysis data set further includes,

[0074] performing a reverse PTR record query on the authoritative DNS server IP to obtain the NS name;

[0075] Resolving the ownership information of the authoritative DNS server IP through WHOIS query or preset IP database, for identifying the operation subject of the abnormal node;

[0076] According to the DNS response flag bit, marking whether the authoritative DNS server IP is a legal authorized server, to assist in abnormal root cause positioning.

[0077] It should be noted that based on the multi-dimensional service quality analysis of the analysis data set, in addition to generating the core statistical indicators of the authoritative DNS server IP dimension and domain / domain name dimension, further resolution and marking operations are performed on the authoritative DNS server IP to enhance the comprehensiveness of service quality evaluation and the accuracy of abnormal root cause positioning. These extended functions obtain the NS name, ownership information and authorization status of the authoritative DNS server through reverse PTR record query, WHOIS query or preset IP database resolution and DNS response flag bit analysis, providing key context information for subsequent problem positioning and improving the practicality and traceability of the analysis results.

[0078] Further, reverse PTR record query is performed on each authoritative DNS server IP extracted in the analysis data set to obtain the corresponding NS name (such as ns1.cloudflare.com). This operation maps the IP address to its associated name server identifier through the reverse resolution mechanism of the DNS protocol, generating a structured NS name field. The acquisition of the NS name helps to clarify the identity and role of the authoritative DNS server, facilitating the correlation of multiple IP addresses of the same service provider in multi-dimensional analysis and identifying the overall service quality performance of the service provider. For example, if multiple authoritative DNS server IPs are mapped to the same NS name and all have high error rates, it can be inferred that the DNS infrastructure of the service provider has systematic problems. The NS name data generated in this step provides direct input for subsequent ownership resolution and abnormal positioning.

[0079] Further, based on the NS name obtained by the reverse PTR query or directly based on the authoritative DNS server IP, the WHOIS query or the pre-stored IP database is used to further analyze the information of the home company or organization (such as Cloudflare, Inc. or Google LLC) of the IP, so as to identify the operation subject of the abnormal node. The WHOIS query obtains the registration information of the authoritative DNS server IP by accessing the domain name registration database, including the name and contact information of the operation subject; the pre-stored IP database quickly provides the home information through the locally stored IP home mapping table, and is suitable for high-performance analysis scenarios. The home information generated in this step provides a key clue for abnormal root cause positioning. For example, when a high SERVFAIL error rate occurs in a certain authoritative DNS server IP, the home information can help the operation and maintenance personnel to contact the corresponding operator for problem troubleshooting. In addition, the home information supports the generation of an abnormal report, which facilitates the output of a structured abnormal node description.

[0080] Further, according to the DNS response flag bit (such as the authoritative answer flag AA) in the log data, it is marked whether each authoritative DNS server IP is the legal authorized server of the queried domain name, so as to distinguish the authorized server and the unauthorized intermediate node (such as a load balancer or a cache server). This marking is realized by analyzing the flag bit in the DNS response message. If the AA flag is set, it indicates that the IP is a legal authorized server; otherwise, it may be an intermediate node. The authorized state marking in this step provides an important basis for abnormal root cause positioning. For example, if the failure range of the legal authorized server is wide, it may cause a large range of domain name resolution failure, and the failure of the unauthorized intermediate node usually has a limited impact. The authorized state marking, in combination with the NS name and the home information, further enriches the context information of the authoritative DNS server, and supports more accurate problem positioning.

[0081] In one specific embodiment of the present application, a recursive query behavior link model is constructed based on the recursive query related fields, specifically,

[0082] Based on the timestamps, query domain names, client IPs, authoritative DNS server IPs, NS names and response codes in the preprocessed log, the query paths are sequentially formed in the order of timestamps;

[0083] Based on the query path and the NS name, the interaction link of a plurality of authoritative DNS servers involved in the recursive query process is reconstructed, and the authorized state of each server is marked in combination with the authorized state marking, so as to visualize the abnormal query path.

[0084] It should be noted that the behavior link model of recursive query based on the construction of recursive query related fields aims to reproduce the complete interaction path of recursive DNS query through the structured analysis of preprocessed log data, reveal the behavior and performance of multiple authoritative DNS servers involved in the query process, and provide visual basis for root cause positioning of service quality anomalies. The construction of the behavior link model utilizes the key fields in the preprocessed log, generates an ordered query path through timestamp sorting and field association, and accurately restores the interaction link of recursive query by combining NS name and authorization state markers, thereby supporting accurate diagnosis and visual analysis of abnormal problems.

[0085] Further, based on the timestamp, query domain name, client IP, authoritative DNS server IP, NS name and response code fields in the preprocessed log, the query path is formed in timestamp order. The specific operation includes:

[0086] Field extraction and sorting: Extract the record of each recursive query from the preprocessed log data set, including timestamp (the specific time of recording request and response), query domain name (the domain name requested by the user for resolution, such as www.example.com), client IP (the client address initiating the query), authoritative DNS server IP (the destination server address involved in the recursive query), NS name (the name server identifier obtained through reverse PTR query, such as ns1.cloudflare.com) and response code (the status code of DNS response, such as NOERROR, SERVFAIL).

[0087] Timestamp sorting: According to the chronological order of timestamp, the record of each query is concatenated into an ordered query path, reflecting the complete process from client request initiation to response reception. For example, for a request to query the domain name example.com, the path may include client IP initiating the query, recursive DNS node sending request to authoritative DNS server IP, receiving response, etc.

[0088] Path association: Associate multiple query records through query domain name and client IP to ensure the integrity of the same query session path; identify the result of each interaction (such as success, failure or error) through response code to provide basis for subsequent abnormal analysis.

[0089] Further, based on the above query path and NS name, the interaction link of multiple authoritative DNS servers involved in the recursive query process is further reconstructed, and the role of each server is marked in combination with the authorization state marker. The specific operation includes:

[0090] Interaction link reconstruction: Utilize the authoritative DNS server IP and NS name in the query path to identify multiple authoritative DNS servers involved in each query, and construct the complete interaction link in timestamp order. For example, for the recursive process of querying example.com, the link may include the recursive DNS node sending a request to ns1.cloudflare.com (authoritative DNS server IP 1), receiving a response and sending a subsequent request to ns2.cloudflare.com (authoritative DNS server IP 2), etc. Link reconstruction ensures the accuracy of the role and interaction order of each node in the link by associating the NS name and query domain name.

[0091] Authorization status marking: Combine the DNS response flag bit (such as the authoritative answer flag AA) in the pre-processing log to mark whether each authoritative DNS server IP is the legal authorized server for the query domain name. If the flag bit AA is set, it is marked as a legal authorized server; otherwise, it is marked as an unauthorized intermediate node (such as a load balancer or cache server). Authorization status marking is achieved by analyzing DNS response packets, providing key information for distinguishing the scope of failure impact. For example, the failure of a legal authorized server may cause a large-scale domain name resolution failure, while the failure of an unauthorized intermediate node usually has a smaller impact.

[0092] Visualization support: Store the reconstructed interaction link and authorization status marking in structured data form to support visual presentation of abnormal query paths. For example, through a graphical interface, each node (client → recursive DNS node → authoritative DNS server) in the query path and its status (success, failure, delay) are displayed, making it easy for operation and maintenance personnel to intuitively identify abnormal links.

[0093] In one specific embodiment of the present application, the root cause of the quality of service anomaly is located, specifically,

[0094] When multiple domain names have a decrease in resolution success rate or P95 / P99 response time delay exceeding a preset threshold on the same authoritative DNS server IP, it is identified as a failure of the authoritative DNS server;

[0095] When a single domain name has resolution anomalies on multiple authoritative DNS server IPs, it is identified as a domain name configuration error or improper TTL setting;

[0096] When the anomaly is concentrated in a specific time period, it is identified as a recursive DNS node or egress network failure;

[0097] When the anomaly time distribution is scattered, it is identified as network hijacking or DNS pollution;

[0098] When the failure rate of a specific query type is significantly high, it is identified as an operation policy restriction, record missing, or security blocking policy taking effect.

[0099] It should be noted that the root cause of the positioning service quality anomaly is to systematically identify the root cause of the recursive DNS service quality anomaly by cross-analyzing multi-dimensional service quality statistical indicators and recursively querying link models, and attributing the anomaly to one of the six categories of root causes: authoritative DNS server failure, recursive DNS node or egress network failure, domain name configuration problem, security blocking policy effect, specific network link quality problem, network hijacking or DNS pollution. As shown in FIG. 3, this process realizes automatic and accurate root cause analysis by presetting thresholds, comparing indicators and analyzing time distribution, combined with the visualization path of the behavior link model, to provide a clear action guide for rapid response and repair. The positioning logic is divided into the following steps, which are based on multi-dimensional analysis of statistical indicators (such as success rate, P95 / P99 response time) and interactive paths in the behavior link model for comprehensive judgment.

[0100] Further, when multiple domain names show a decrease in resolution success rate (i.e., the proportion of requests with a response code of NOERROR is below a preset threshold) or P95 / P99 response time exceeds a preset threshold on the same authoritative DNS server IP, it is identified as a failure of the authoritative DNS server. The specific operation includes:

[0101] Index analysis: Extract the statistical indicators of the authoritative DNS server IP dimension from the multi-dimensional analysis results, and check whether the success rate and P95 / P99 time of multiple domain names on the IP are abnormal. For example, if multiple domain names (such as example.com, test.com) show a significant increase in SERVFAIL response code proportion or P99 time delay on the same IP (such as the IP corresponding to ns1.cloudflare.com), it indicates that the server may have hardware failure, software error or overload problem.

[0102] Link verification: Combined with the behavior link model, confirm whether the query paths of abnormal domain names are all directed to the authoritative DNS server IP to ensure that the commonality of the anomaly is directed to a single server.

[0103] Further, when a single domain name shows resolution anomalies (such as success rate below threshold or returns SERVFAIL / NXDOMAIN response code) on multiple authoritative DNS server IPs, it is identified as a domain name configuration error or improper TTL setting. The specific operation includes:

[0104] Indicator Analysis: Extract the success rate, error rate, and NXDOMAIN rate of a single domain name from the statistical indicators of the domain / domain name dimension, and check its performance on multiple NS servers (corresponding to different authoritative DNS server IPs). For example, if example.com shows a high SERVFAIL rate on ns1.cloudflare.com and ns2.cloudflare.com, it indicates that the problem may be caused by the domain name itself rather than a single server.

[0105] Link Verification: Through the behavior link model, confirm that the domain name is abnormal in the query path of all related authoritative DNS servers, excluding the possibility of single server failure.

[0106] Root Cause Inference: Based on DNS protocol knowledge, infer that the abnormal reason may include incorrect deletion of domain name records, DNS hosting service failure, registration expiration, or TTL value setting too long causing record update delay. This step accurately distinguishes domain-level problems from server-level problems through detailed analysis.

[0107] Further, when the anomaly is concentrated in a specific time period (such as multiple domain names showing a decrease in success rate or high latency within an hour), identify the recursive DNS node or its egress network failure. The specific operation includes:

[0108] Time Distribution Analysis: Extract the time series of statistical indicators from the time series database, and check if the anomaly is concentrated in a specific time window. For example, if multiple domain names show a sharp increase in P95 / P99 latency or SERVFAIL rate within a certain time period, it indicates that the problem may be related to the recursive DNS node.

[0109] Link Verification: Through the behavior link model, confirm whether the abnormal query path involves the egress link of the recursive DNS node, rather than a specific authoritative DNS server.

[0110] Root Cause Inference: Infer that the anomaly may be caused by CPU / memory resource exhaustion of the recursive DNS node, software crash, firewall policy blocking, or data center egress network congestion. This step quickly locates infrastructure-level failures through time-dimension focused analysis.

[0111] Further, when the anomaly time distribution shows dispersion (such as multiple domain names experiencing intermittent resolution failure or high latency at different time points), identify network hijacking or DNS pollution. The specific operation includes:

[0112] Time distribution analysis: Extract the time distribution of abnormal indicators from the time series database, and check if it presents non-continuous and non-centralized characteristics. For example, if abnormal domain names (such as example.com, test.com) show random SERVFAIL or NXDOMAIN responses at different time points, it indicates that there may be external interference.

[0113] Link verification: Through the behavior link model, confirm whether the abnormal query path involves multiple authoritative DNS servers and has no obvious common failure points.

[0114] Root cause inference: Combine DNS protocol and network security knowledge to infer that the anomaly may be caused by network hijacking (such as man-in-the-middle attack tampering DNS response) or DNS pollution (such as regional policy interference). This step identifies external attacks in complex network environments through dispersion analysis.

[0115] Further, when the failure rate of a specific query type (such as AAAA, TXT) is significantly higher, it is identified as an operational policy restriction, record missing, or security blocking policy in effect. The specific operation includes:

[0116] Indicator analysis: Extract statistical indicators of query type dimensions from multi-dimensional analysis results, and check if the SERVFAIL or NXDOMAIN rate of a specific QType (such as AAAA) is abnormal. For example, if the failure rate of AAAA query is much higher than A query, it may indicate that the authoritative DNS server does not configure IPv6 records or there is a policy restriction.

[0117] Link verification: Through the behavior link model, confirm whether the abnormal query path involves the processing link of a specific query type.

[0118] Root cause inference: Combine log data and pre-set blocking list to check if the anomaly is caused by the operator's security blocking policy (such as intercepting malicious domain names), DNS record missing, or operational policy restriction (such as limiting specific query types). This step accurately identifies strategic anomalies through fine-grained analysis of query type dimensions.

[0119] In one specific embodiment of the present application, an abnormal report is generated, specifically,

[0120] Based on the root cause positioning result, the IP address, attribution information of the abnormal authoritative DNS server and the list of affected domain names are output;

[0121] Based on the statistical indicators, the domain name ranking of poor service quality is generated according to the resolution failure rate or P95 / P99 response time delay;

[0122] Based on the root cause positioning result, the time period and frequency of abnormal resolution behavior are counted, and an abnormal report is generated.

[0123] It should be noted that the generation of the abnormal report is aimed at generating a structured abnormal report based on the root cause positioning result and the multi-dimensional service quality statistical indicators, clearly presenting the detailed information of the recursive DNS service quality anomaly, including the abnormal authoritative DNS server, the list of affected domain names, the ranking of domain names with poor service quality, and the time distribution and frequency of abnormal behavior, providing operational guidance for operation and maintenance personnel, and promoting rapid problem repair and DNS service optimization. The abnormal report integrates the output of the root cause positioning result, statistical indicators and behavior link model, and uses an automated generation method to ensure the comprehensiveness, accuracy and practicality of the content. The report data is stored in a structured form in a time series database, supporting real-time display and historical tracking.

[0124] Further, based on the root cause positioning result, the IP address of the abnormal authoritative DNS server, the attribution information and the list of affected domain names are output. The specific operation includes:

[0125] Abnormal server IP address: Extract the IP address of the authoritative DNS server identified as a fault or performance bottleneck from the root cause positioning result (such as the IP corresponding to ns1.cloudflare.com), to specify the specific node of the anomaly.

[0126] Attribution information: Use the attribution company or organization information (such as Cloudflare, Inc.) parsed by WHOIS query or pre-set IP database in multi-dimensional analysis to provide a basis for operation and maintenance personnel to contact relevant service providers. For example, if the SERVFAIL error rate of a certain IP address is significantly higher, its attribution information can help confirm whether the problem is caused by a specific operator.

[0127] List of affected domain names: Based on the behavior link model and the root cause positioning result, list the domain names affected by the abnormal authoritative DNS server (such as example.com, test.com), and confirm the resolution failure or high latency of these domain names on the IP through path association query.

[0128] Further, based on the statistical indicators of multi-dimensional analysis, sort the domain names by resolution failure rate or P95 / P99 response time to generate a ranking of domain names with poor service quality. The specific operation includes:

[0129] Indicator extraction: Extract the resolution failure rate (i.e. 1 minus the success rate of response code NOERROR) and P95 / P99 response time from the statistical indicators of domain / domain name dimension, reflecting the resolution reliability and delay performance of the domain name.

[0130] Ranking logic: Sort by failure rate from high to low or P95 / P99 latency from large to small, generate a TOPN (e.g. TOP 10) ranking of domain names with poor service quality. For example, if example.com has a failure rate of 10% or a P99 latency of more than 200ms, it will be included in the top of the ranking.

[0131] Ranking content: The ranking list includes domain names, failure rates, P95 / P99 latency values, and corresponding NS server information, which facilitates the quick identification of domain names and related authoritative DNS servers that need to be prioritized by operation and maintenance personnel.

[0132] Further, based on the root cause positioning results, the time period and frequency of abnormal resolution behavior are counted to generate an abnormal analysis report in the time dimension. The specific operations include:

[0133] Time period analysis: Extract the time series of abnormal indicators (such as success rate drop, P95 / P99 latency threshold) from the time series database, identify the time window (such as 14:00-15:00 on a certain day) where the abnormality occurs. For example, if multiple domain names show a sharp increase in SERVFAIL rate in a specific time period, the report will mark that time period as an abnormal high period.

[0134] Frequency statistics: Calculate the number of occurrences of abnormal events in each time period to quantify the severity of the abnormality. For example, count the number of NXDOMAIN responses in a certain time period to reflect the scale of garbage domain names or configuration errors.

[0135] Report integration: Combine time period and frequency statistics with root cause positioning results to clearly associate abnormalities with specific root causes (such as recursive DNS node failure, network hijacking), providing time-dimension repair guidance for operation and maintenance personnel.

[0136] In the second embodiment of the present application, the present application provides a system for evaluating the service quality of recursive DNS based on log analysis, as shown in Figure 4 The system includes a log collection module 1, an analysis module 2, a behavior link construction module 3, and a root cause positioning module 4.

[0137] The log collection module 1 is used to collect log data of recursive DNS nodes, extract recursive query related fields and perform preprocessing to form a structured analysis data set.

[0138] The analysis module 2 is used to perform multi-dimensional service quality analysis based on the analysis data set to generate statistical indicators.

[0139] The behavior link construction module 3 is used to construct a behavior link model of recursive queries based on recursive query related fields.

[0140] The root cause positioning module 4 is configured to locate the root cause of the service quality anomaly and generate an anomaly report by cross-analyzing the statistical indicators and the behavior link model.

[0141] In the third embodiment of the present application, the present application provides an electronic device comprising a memory and a processor, characterized in that the memory stores a computer program executable on the processor, and the processor implements the steps of the method for evaluating the recursive DNS service quality based on log analysis when executing the program.

[0142] In the fourth embodiment of the present application, the present application provides a storage medium storing a computer program, characterized in that the computer program implements the steps of the method for evaluating the recursive DNS service quality based on log analysis when executed by a processor.

[0143] In summary, the present application provides a method and system for evaluating the recursive DNS service quality based on log analysis, which comprehensively covers the recursive DNS resolution behavior through full-quantity log collection and multi-dimensional analysis, overcomes the defects of limited coverage and coarse granularity of the traditional probing method, accurately locates the root cause of the service quality anomaly through behavior link restoration and systematic root cause positioning logic, solves the problem that the prior art cannot trace the resolution failure or delay, accurately captures the tail delay by using the quantile value statistical method, improves the accuracy and real-time performance of the evaluation, and provides an operable guide for DNS service optimization.

[0144] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described modules can refer to the corresponding process in the foregoing method embodiments, which will not be described herein.

[0145] The modules described as separate components can or can not be physically separated, and the components shown as modules can or can not be physical modules, i.e., they can be located in one place or distributed on multiple network modules. Part or all of the modules can be selected according to actual needs to achieve the purpose of the present embodiment.

[0146] In addition, each functional module in each embodiment of the present application can be integrated in one processing module, or each module can exist physically alone, or two or more modules can be integrated in one module. The integrated module can be realized in the form of hardware or in the form of hardware plus software functional module.

[0147] The integrated module realized in the form of the software function module can be stored in a computer readable storage medium. The software function module is stored in a storage medium, and includes a plurality of instructions for enabling a computer system (which can be a personal computer, a server, or a network system, etc.) or a processor to execute part of steps of the method described in each embodiment of the present application. The storage medium includes a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various storage medium capable of storing program codes.

[0148] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that the technical solutions recorded in the foregoing embodiments can still be modified, or some technical features can be replaced by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for evaluating the quality of recursive DNS services based on log analysis, characterized in that: include, Collect log data from recursive DNS nodes, extract recursive query-related fields and preprocess them to form a structured analysis dataset; Based on the analysis dataset, perform multi-dimensional service quality analysis and generate statistical indicators; Construct a behavior chain model for recursive queries based on fields related to recursive queries; By cross-analyzing statistical indicators and behavioral link models, the root causes of service quality anomalies can be located and anomaly reports can be generated.

2. The method for evaluating recursive DNS service quality based on log analysis according to claim 1, characterized in that: The process of collecting log data from recursive DNS nodes, extracting recursive query-related fields, and performing preprocessing includes: By continuously listening to port 53, we can obtain all request and response logs and extract timestamps, client IPs, query domains, query types, response codes, response times, and authoritative DNS server IPs. The preprocessing includes filtering out log records with incorrect or incomplete formats, aligning timestamps, standardizing numerical fields of response times, and normalizing the query domain name to a valid top-level domain plus a first-level domain name for aggregation analysis, while retaining the original query domain name for micro-analysis.

3. The method for evaluating recursive DNS service quality based on log analysis according to claim 2, characterized in that: The multi-dimensional service quality analysis based on the analyzed dataset generates statistical indicators, including: Grouped by authoritative DNS server IP as primary key, the total number of recursions, the success rate of NOERROR response code, the error rate of SERVFAIL response code, the error rate of NXDOMAIN response code, and the P50, P95, and P99 quantiles of response time are calculated. Grouping by normalized domain names as primary keys, and drilling down to the complete query domain name, the system calculates the total number of recursions, success rate, error rate, NXDOMAIN rate, and P50, P95, and P99 quantiles, and compares the service quality differences of the same domain name on multiple NS servers.

4. The method for evaluating recursive DNS service quality based on log analysis according to claim 3, characterized in that: The multi-dimensional service quality analysis based on the analytical dataset, which generates statistical indicators, also includes: Perform a reverse PTR record lookup on the authoritative DNS server IP to obtain the NS name; The attribution information of the authoritative DNS server IP is obtained by querying WHOIS or resolving the pre-configured IP database, which is used to identify the operating entity of the abnormal node; The authoritative DNS server IP is marked with a DNS response flag to indicate whether it is a legally authorized server, in order to assist in locating the root cause of the anomaly.

5. The method for evaluating recursive DNS service quality based on log analysis according to claim 4, characterized in that: The behavioral chain model for constructing recursive queries based on recursive query-related fields includes, The query path is formed by concatenating the timestamps, query domain name, client IP, authoritative DNS server IP, NS name and response code in the preprocessed log in the order of timestamps. Based on the query path and NS name, the interaction links of multiple authoritative DNS servers involved in the recursive query process are reconstructed, and the authorization status of each server is marked with authorization status flags to visualize abnormal query paths.

6. The method for evaluating recursive DNS service quality based on log analysis according to claim 5, characterized in that: The root causes of the location service quality anomalies include, When multiple domain names on the same authoritative DNS server IP experience a decrease in resolution success rate or P95 / P99 response latency exceeding a preset threshold, it is identified as a failure of that authoritative DNS server. When a single domain name fails to resolve on multiple authoritative DNS server IPs, it is identified as a domain name configuration error or an improper TTL setting. When anomalies are concentrated in a specific time period, they are identified as recursive DNS node or egress network failures. When abnormal time distributions are scattered, they are identified as network hijacking or DNS poisoning; When the failure rate of a specific query type is significantly high, it is identified as an operational strategy restriction, missing record, or security blocking strategy in effect.

7. The method for evaluating recursive DNS service quality based on log analysis according to claim 6, characterized in that: The generation of the anomaly report includes, Based on the root cause analysis results, output the IP address, ownership information, and list of affected domain names of the abnormal authoritative DNS server. Based on statistical indicators, a ranking of domains with poor service quality is generated by sorting them by resolution failure rate or P95 / P99 response latency. Based on the root cause localization results, the time period and frequency of abnormal analysis behaviors are statistically analyzed, and anomaly reports are generated.

8. A system for evaluating the quality of recursive DNS services based on log analysis, characterized in that: It includes a log collection module, an analysis module, a behavior chain construction module, and a root cause localization module; The log collection module is used to collect log data of recursive DNS nodes, extract recursive query-related fields and preprocess them to form a structured analysis dataset. The analysis module is used to perform multi-dimensional service quality analysis based on the analysis dataset and generate statistical indicators. The behavior link construction module is used to construct a behavior link model for recursive queries based on recursive query related fields; The root cause localization module is used to locate the root cause of service quality anomalies and generate an anomaly report by cross-analyzing statistical indicators and behavioral link models.

9. An electronic device, comprising a memory and a processor, characterized in that: The memory stores a computer program that can run on the processor, and when the program is executed on the processor, it implements the steps in the method for evaluating the quality of recursive DNS service based on log analysis as described in any one of claims 1-7.

10. A storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, it implements the steps in the method for evaluating the quality of recursive DNS services based on log analysis as described in any one of claims 1-7.

Images