Domain name resolver cache pattern recognition method based on timing consistency analysis
By identifying the caching patterns of DNS forwarders through time-series consistency analysis, the problem of blind spots in existing technologies is solved, and technical support for security assessment of DNS infrastructure and optimization of resolver deployment is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-25
- Publication Date
- 2026-03-24
AI Technical Summary
Existing technologies lack methods for identifying DNS resolver caching patterns, resulting in blind spots in edge scenarios such as TTL tampering and single upstream dependency, which affects the security assessment of DNS infrastructure and the optimization of resolver deployment strategies.
Using a time-series consistency analysis method, the detector sends domain name query and version query commands to the target forwarder. The IP address, timestamp, and TTL value in the domain name server response are analyzed, and combined with the version information, it is determined whether the forwarder's caching mode is independent or transparent caching.
It enables accurate identification of DNS forwarder caching behavior, solves the problem of blind spots in identification, and provides technical support for assessing the security risks of DNS infrastructure and defending against DDoS attacks.
Smart Images
Figure CN121396675B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of Internet security monitoring technology, and in particular relates to a method for identifying domain name resolver cache patterns based on time-series consistency analysis. Background Technology
[0002] The Domain Name System (DNS), a critical infrastructure supporting the operation of the Internet, plays a vital role in translating easy-to-remember domain names into IP addresses that computers can process. The DNS's hierarchical naming system comprises multiple levels, including root domains, top-level domains, and second-level domains. Its name resolution process is accomplished through the collaborative work of a distributed server cluster. When a user initiates a domain name query request, the DNS system employs a hybrid mechanism combining recursive and iterative queries to provide efficient address resolution services. In this process, the caching technology used by the forwarders plays a crucial role in improving query efficiency and reducing network load.
[0003] The DNS infrastructure consists of several components with different functions, primarily including Open Resolvers, which provide recursive query services, and Authoritative Name Servers, which perform iterative queries. Authoritative Name Servers are specifically responsible for storing and managing resource records for specific domain names, while Open Resolvers assist end users in retrieving this record data.
[0004] A typical domain name resolution process, such as when a user needs to obtain the IP address corresponding to http: / / www.example.com, involves a recursive server that iteratively queries the root server, the ".com" top-level domain server, and the example.com second-level domain server in a hierarchical order. Ultimately, it obtains the resource record from the authoritative name server and returns it to the requester. During this process, the recursive server automatically caches the obtained response results. Within the Time-to-Live (TTL), it can directly return the cached content for the same query request, thus avoiding repeated hierarchical queries and significantly reducing query latency and network bandwidth consumption.
[0005] In the actual recursive query process, in order to obtain the resource records of a domain name, the system first initializes a query request, which is usually initiated by the forwarding resolver (i.e., the forwarder). The forwarder forwards the query request to the upstream recursive resolver, which then recursively queries authoritative name servers at various levels to ultimately complete the domain name resolution.
[0006] Based on whether the forwarder independently maintains a cache of DNS resource records, its caching behavior can be divided into two typical modes:
[0007] Independent caching mode: The forwarder maintains a complete caching system independently, storing the TTL values of resource records returned by the upstream resolver and cache records in the local cache. When a query request that hits the cache is received, the local valid cache is used first to generate a response, thereby reducing the number of queries to the upstream resolver and improving parsing efficiency.
[0008] Transparent caching mode: The forwarder does not maintain a local cache and relies entirely on the upstream parser's caching system. All query requests are forwarded to the upstream parser for parsing, which simplifies the design of the forwarder and reduces maintenance costs.
[0009] However, existing technologies lack methods for identifying cache patterns. Summary of the Invention
[0010] This invention proposes a domain name resolver cache pattern recognition method based on time-series consistency analysis, which solves the technical problems mentioned above.
[0011] The first aspect of this invention proposes a method for identifying domain name resolver cache patterns based on time-series consistency analysis, the method comprising:
[0012] Step S1: Deploy the Domain Name System, which includes authoritative domain name servers, several forwarders, and a cluster of recursive resolvers located upstream of the forwarders. There is a many-to-many correspondence between forwarders and recursive resolvers.
[0013] Step S2: The detector sends multiple consecutive domain name query commands for the same domain name to the target repeater, obtaining the IP address of the upstream recursive resolver used for data collection, the time when the domain name server received the domain name query command, and the TTL value of the resource record in the domain name query response from the message returned by the domain name server in each domain name query command; the detector also sends multiple consecutive version query commands to the target repeater to obtain the version of the same domain name server software version, obtaining the version information from the message returned by the domain name server in each version query command.
[0014] The domain name query command includes the IP code of the target forwarder. Both the domain name query command and the version query command are resolved by the authoritative domain name server. The resolved command is forwarded by the target forwarder to the recursive resolver, and then sent by the recursive resolver to the corresponding domain name server.
[0015] Step S3: The method ends when the IP address of the upstream recursive resolver used for data collection returned by each domain name query command is the same as the IP address of the target forwarder;
[0016] Otherwise, the method ends when all the IP addresses of the upstream recursive resolvers used for data collection in the messages returned by each domain name query command are the same;
[0017] Otherwise, the messages returned by each domain name query command are sorted in ascending order of the time when the domain name server received the domain name query command. Based on the sorting order, the TTL value of the resource record in the domain name query response corresponding to each message is obtained. When all TTL values show a linear decreasing trend and the version information in the messages returned by all version query commands is consistent, the caching mode of the target forwarder is independent caching. When all TTL values show multiple linear jumps and the version information in the messages returned by all version query commands is not completely consistent, the caching mode of the target forwarder is transparent mode.
[0018] In the independent caching mode, the target forwarder maintains its own local domain name resource record cache copy; in the transparent caching mode, the target forwarder does not maintain a local domain name resource record cache copy.
[0019] Preferably, all TTL values are fitted to a straight line, and the coefficient of determination obtained from the fitting is R; in R 2 When the TTL value is ≥ 0.98 and the absolute deviation of all TTL values from the fitted straight line does not exceed ±1 TTL unit, it is determined that all TTL values show a linear decreasing trend.
[0020] Preferably, the fitting method is the least squares method.
[0021] Preferably, all TTL values are divided into several groups according to the upstream recursive resolver IP address in the corresponding message, and the TTL values in each group are sorted according to the timestamp of the query processed by the resolver.
[0022] The TTL value within each group shows a linear decreasing trend. When the difference between the first TTL values of different groups is greater than the first preset threshold, it is determined that all TTL values show a multi-linear jump.
[0023] Preferably, the first preset threshold is 2 TTL units.
[0024] Preferably, all TTL values are divided into several groups according to the upstream recursive resolver IP address in the corresponding message, and the TTL values in each group are sorted according to the timestamp of the query processed by the resolver.
[0025] When the TTL value within each group shows a linear decreasing trend and the rate of decrease of the representative TTL value is greater than the second preset threshold, it is determined that all TTL values exhibit a multi-linear jump; the representative TTL value is the first TTL value within the group.
[0026] Preferably, the authoritative domain name server is a server with full administrative authority.
[0027] A second aspect of the present invention proposes a domain name resolver cache pattern identification device based on time-series consistency analysis, the device comprising:
[0028] Initialization module: Configured to deploy the Domain Name System, which includes authoritative name servers, several forwarders, and a cluster of recursive resolvers located upstream of the forwarders. There is a many-to-many correspondence between forwarders and recursive resolvers.
[0029] Data acquisition module: Configured to send multiple consecutive domain name query commands for the same domain name to the target repeater, and obtain the IP address of the upstream recursive resolver used for data collection, the time when the domain name server received the domain name query command, and the TTL value of the resource record in the domain name query response from the message returned by the domain name server in each domain name query command; The detector also sends multiple consecutive version query commands to the target repeater to obtain the version of the same domain name server software, and obtains the version information from the message returned by the domain name server in each version query command;
[0030] The domain name query command includes the IP code of the target forwarder. Both the domain name query command and the version query command are resolved by the authoritative domain name server. The resolved command is forwarded by the target forwarder to the recursive resolver, and then sent by the recursive resolver to the corresponding domain name server.
[0031] Judgment module: Configured to end the judgment when the IP address of the upstream recursive resolver used for data collection returned by each domain name query command is the same as the IP address of the target forwarder;
[0032] Otherwise, the judgment ends when all the IP addresses of the upstream recursive resolvers used for data collection in the messages returned by the domain name query commands are the same;
[0033] Otherwise, the messages returned by each domain name query command are sorted in ascending order of the time when the domain name server received the domain name query command. Based on the sorting order, the TTL value of the resource record in the domain name query response corresponding to each message is obtained. When all TTL values show a linear decreasing trend and the version information in the messages returned by all version query commands is consistent, the caching mode of the target forwarder is independent caching. When all TTL values show multiple linear jumps and the version information in the messages returned by all version query commands is not completely consistent, the caching mode of the target forwarder is transparent mode.
[0034] In the independent caching mode, the target forwarder maintains its own local domain name resource record cache copy; in the transparent caching mode, the target forwarder does not maintain a local domain name resource record cache copy.
[0035] A third aspect of the present invention provides an electronic device, the electronic device comprising:
[0036] At least one processor; and
[0037] A memory communicatively connected to the at least one processor; wherein,
[0038] The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method as described above.
[0039] A fourth aspect of the present invention provides a non-transitory computer-readable storage medium storing computer instructions for causing the computer to perform the method described above.
[0040] This invention sets up a query command and adds the address (rdata_IP) of the upstream recursive resolver and the timestamp (rdata_time) of the query processing to the returned message. Combined with a multi-dimensional detection strategy, it achieves accurate identification of DNS forwarder caching behavior. By constructing a specific request message and obtaining specific response information from the target forwarder, it achieves accurate identification of DNS forwarder caching behavior, solving the identification blind spot problem caused by edge scenarios such as TTL tampering and single upstream dependency in existing technologies. This provides technical support for assessing DNS infrastructure security risks, optimizing resolver deployment strategies, and defending against DDoS attacks. Attached Figure Description
[0041] Figure 1 This is a flowchart illustrating the domain name resolver cache pattern recognition method based on time-series consistency analysis provided by the present invention. Detailed Implementation
[0042] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this disclosure, and not all embodiments. Based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.
[0043] like Figure 1 As shown, a method for identifying domain name resolver cache patterns based on time-series consistency analysis is described. The method includes:
[0044] Step S1: Deploy the Domain Name System. The domain system includes authoritative domain name servers, several forwarders, and a cluster of recursive resolvers located upstream of the forwarders. There is a many-to-many correspondence between forwarders and recursive resolvers.
[0045] Step S2: The detector sends multiple consecutive domain name query commands for the same domain name to the target repeater, obtaining the IP address of the upstream recursive resolver used for data collection, the time when the domain name server received the domain name query command, and the TTL value of the resource record in the domain name query response from the message returned by the domain name server in each domain name query command; the detector also sends multiple consecutive version query commands to the target repeater to obtain the version of the same domain name server software version, obtaining the version information from the message returned by the domain name server in each version query command.
[0046] The domain name query command includes the IP code of the target forwarder. Both the domain name query command and the version query command are resolved by the authoritative domain name server. The resolved command is forwarded by the target forwarder to the recursive resolver, and then sent by the recursive resolver to the corresponding domain name server.
[0047] Step S3: The method ends when one of the IP addresses of the upstream recursive resolvers used for data collection returned by each domain name query command is the same as the IP address of the target forwarder;
[0048] Otherwise, the method ends when all the IP addresses of the upstream recursive resolvers used for data collection in the messages returned by each domain name query command are the same;
[0049] Otherwise, the messages returned by each domain name query command are sorted in ascending order of the time when the domain name server received the domain name query command. Based on the sorting order, the TTL value of the resource record in the domain name query response corresponding to each message is obtained. When all TTL values show a linear decreasing trend and the version information in the messages returned by all version query commands is consistent, the caching mode of the target forwarder is independent caching. When all TTL values show multiple linear jumps and the version information in the messages returned by all version query commands is not completely consistent, the caching mode of the target forwarder is transparent mode.
[0050] In the independent caching mode, the target forwarder maintains its own local domain name resource record cache copy; in the transparent caching mode, the target forwarder does not maintain a local domain name resource record cache copy.
[0051] The method for identifying the cache mode of a forwarder is to identify the cache mode of the forwarder by customizing probe packets and dynamic responses from authoritative domain name servers. Specifically, this method determines whether the forwarder maintains an independent cache by analyzing the TTL change pattern and version information consistency.
[0052] This invention sets up a method to add the target forwarder IP to the query command, thereby constructing a DNS query message that can effectively identify caching behavior; the domain name server responds to the upstream recursive resolver IP address, the time when the domain name server received the domain name query command, and the TTL value of the resource record in the domain name query response in the message returned by each domain name query command, thereby realizing dynamic response and injection of key information.
[0053] The domain name server responds to each version query command by obtaining software version information (such as version number, custom identifier, etc.) from the domain name server, combining the version information into a message, and returning the response message carrying the version information through several recursive resolvers and several forwarders.
[0054] Furthermore, all TTL values are fitted to a straight line, and the coefficient of determination obtained from the fitting is R; in R 2 When the TTL value is ≥ 0.98 and the absolute deviation of all TTL values from the fitted straight line does not exceed ±1 TTL unit, it is determined that all TTL values show a linear decreasing trend.
[0055] All TTL values are divided into several groups according to the upstream recursive resolver IP address in their corresponding packets, and the TTL values in each group are sorted according to the timestamp of the query processed by the resolver.
[0056] The TTL value within each group shows a linear decreasing trend. When the difference between the first TTL values of different groups is greater than the first preset threshold, it is determined that all TTL values show a multi-linear jump.
[0057] All TTL values are divided into several groups according to the upstream recursive resolver IP address in their corresponding packets, and the TTL values in each group are sorted according to the timestamp of the query processed by the resolver.
[0058] When the TTL value within each group shows a linear decreasing trend and the rate of decrease of the representative TTL value is greater than the second preset threshold, it is determined that all TTL values exhibit a multi-linear jump; the representative TTL value is the first TTL value within the group.
[0059] Authoritative name servers are servers with full administrative authority that manage domain name resolution records and provide a trusted mapping relationship between domain names and IP addresses.
[0060] This invention sets up a query command, adds the address (rdata_IP) of the upstream recursive resolver and the timestamp (rdata_time) of the query processing to the returned message, and combines a multi-dimensional detection strategy to achieve accurate identification of DNS forwarder caching behavior.
[0061] This invention provides a specific embodiment of a domain name resolver cache pattern recognition method based on time-series consistency analysis.
[0062] First, repeatedly query the same domain name, recording the TTL value for each query, as well as the upstream recursive resolver IP address (rdata_IP) and the timestamp (rdata_time) of the resolver's query processing, carried in the response message. Then, plot the TTL change distribution with query time on the x-axis and TTL value on the y-axis. Group TTL values with the same rdata_IP into the same large group. Then, within the same group, sort by rdata_time. If a later TTL value shows a non-continuous upward jump relative to the previous TTL value (i.e., reset to a significantly larger value), it is considered the start of a new cache cycle and should be divided into a new subgroup. If the TTL values obtained from the query are distributed along a straight line with a single slope of -1, it indicates that the forwarder uses an independent caching mode. If the TTL value distribution jumps, but the TTL values can be grouped according to the continuity of rdata_IP and rdata_time, and the points within each group can be fitted to a decreasing straight line, it indicates that the forwarder uses a transparent caching mode.
[0063] `version.bind` is an informal standard query supported by the DNS protocol, used to obtain server version information. This invention further verifies the caching pattern using `version.bind` queries: First, multiple queries are performed. Based on the query results, if the version numbers returned by the multiple queries are consistent, it indicates that the response comes from the same resolver, which is clearly a characteristic of independent caching. Conversely, if the version numbers are inconsistent, it indicates that the response comes from different upstream resolvers, which indicates transparent caching.
[0064] In this invention, the modification to the detection mechanism is mainly to avoid DNS caching interference and ensure that each query generates a unique domain name. Therefore, a random prefix and the target forwarder IP address need to be embedded in the queried domain name. Normally, authoritative name servers return static resource records, but to achieve caching behavior identification, the design of the authoritative name server in this invention needs to address the following issues: First, an authoritative name server with full administrative privileges (such as dns-exp.com) needs to be built, supporting dynamic resolution rule configuration; simultaneously, the response content needs to include the upstream recursive resolver IP (rdata_IP) and the query timestamp (rdata_time) to support subsequent analysis.
[0065] Because the caching behavior of DNS forwarders is completely transparent to users—for example, a user host directly receives an IP address after sending a query request to the forwarder, unaware of the forwarder's caching mode—interaction with the resolver's cache is inevitable during domain name resolution: the forwarder will always access its local cache or the upstream resolver's cache when processing a query. The forwarder's caching mechanism directly affects the change patterns of the TTL value and version number in the response message. By collecting this information directly affected by the forwarder's caching mode and analyzing and comparing the data, the forwarder's caching mode can be determined.
[0066] The apparatus provided for carrying out the present invention will be described below. The specific implementation process and technical effects are as described above and will not be repeated below.
[0067] Optionally, embodiments of the present invention provide a domain name resolver cache pattern identification device based on time-series consistency analysis, the device comprising:
[0068] Initialization module: Configured to deploy the Domain Name System, which includes authoritative name servers, several forwarders, and a cluster of recursive resolvers located upstream of the forwarders. There is a many-to-many correspondence between forwarders and recursive resolvers.
[0069] Data acquisition module: Configured to send multiple consecutive domain name query commands for the same domain name to the target repeater, and obtain the IP address of the upstream recursive resolver used for data collection, the time when the domain name server received the domain name query command, and the TTL value of the resource record in the domain name query response from the message returned by the domain name server in each domain name query command; The detector also sends multiple consecutive version query commands to the target repeater to obtain the version of the same domain name server software, and obtains the version information from the message returned by the domain name server in each version query command;
[0070] The domain name query command includes the IP code of the target forwarder. Both the domain name query command and the version query command are resolved by the authoritative domain name server. The resolved command is forwarded by the target forwarder to the recursive resolver, and then sent by the recursive resolver to the corresponding domain name server.
[0071] Judgment module: Configured to end the judgment when the IP address of the upstream recursive resolver used for data collection returned by each domain name query command is the same as the IP address of the target forwarder;
[0072] Otherwise, the judgment ends when all the IP addresses of the upstream recursive resolvers used for data collection in the messages returned by the domain name query commands are the same;
[0073] Otherwise, the messages returned by each domain name query command are sorted in ascending order of the time when the domain name server received the domain name query command. Based on the sorting order, the TTL value of the resource record in the domain name query response corresponding to each message is obtained. When all TTL values show a linear decreasing trend and the version information in the messages returned by all version query commands is consistent, the caching mode of the target forwarder is independent caching. When all TTL values show multiple linear jumps and the version information in the messages returned by all version query commands is not completely consistent, the caching mode of the target forwarder is transparent mode.
[0074] In the independent caching mode, the target forwarder maintains its own local domain name resource record cache copy; in the transparent caching mode, the target forwarder does not maintain a local domain name resource record cache copy.
[0075] The above-described device is used to execute the method provided in the foregoing embodiments, and its implementation principle and technical effect are similar, so they will not be described again here.
[0076] These modules can be one or more integrated circuits configured to implement the above methods, such as one or more Application Specific Integrated Circuits (ASICs), one or more digital signal processors (DSPs), or one or more Field Programmable Gate Arrays (FPGAs). Alternatively, when a module is implemented using processing element scheduler code, the processing element can be a general-purpose processor, such as a Central Processing Unit (CPU) or other processor capable of calling program code. Furthermore, these modules can be integrated together as a system-on-a-chip (SOC).
[0077] The modules described above can be connected or communicate with each other via wired or wireless connections. Wired connections may include metal cables, optical fibers, hybrid cables, or any combination thereof. Wireless connections may include connections via LAN, WAN, Bluetooth, ZigBee, or NFC, or any combination thereof. Two or more modules can be combined into a single module, and any module can be divided into two or more units. Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems and devices described above can be referred to the corresponding processes in the method embodiments, and will not be repeated here.
[0078] It should be noted that these modules can be one or more integrated circuits configured to implement the above methods, such as one or more Application Specific Integrated Circuits (ASICs), one or more Digital Signal Processors (DSPs), or one or more Field Programmable Gate Arrays (FPGAs). Furthermore, when a module is implemented using processing element scheduler code, the processing element can be a general-purpose processor, such as a Central Processing Unit (CPU) or other processor capable of calling program code. Additionally, these modules can be integrated together to form a System-on-a-Chip (SOC).
[0079] The electronic device includes a processor, memory, communication interface, display screen, and input device connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, Near Field Communication (NFC), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input device can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the device's casing, or an external keyboard, touchpad, or mouse.
[0080] The present invention also provides a program product, such as a computer-readable storage medium, including a program that, when executed by a processor, is used to perform the above-described method embodiments.
[0081] In the several embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.
[0082] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.
[0083] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in the form of hardware plus software functional units.
[0084] The integrated units implemented as software functional units described above can be stored in a computer-readable storage medium. These software functional units, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
Claims
1. A method for identifying domain name resolver cache patterns based on time-series consistency analysis, characterized in that, The method includes: Step S1: Deploy the Domain Name System, which includes authoritative domain name servers, several forwarders, and a cluster of recursive resolvers located upstream of the forwarders. There is a many-to-many correspondence between forwarders and recursive resolvers. Step S2: The detector sends multiple consecutive domain name query commands for the same domain name to the target repeater, obtaining the IP address of the upstream recursive resolver used for data collection, the time when the domain name server received the domain name query command, and the TTL value of the resource record in the domain name query response from the message returned by the domain name server in each domain name query command; the detector also sends multiple consecutive version query commands to the target repeater to obtain the version of the same domain name server software version, obtaining the version information from the message returned by the domain name server in each version query command. The domain name query command includes the IP code of the target forwarder. Both the domain name query command and the version query command are resolved by the authoritative domain name server. The resolved command is forwarded by the target forwarder to the recursive resolver, and then sent by the recursive resolver to the corresponding domain name server. Step S3: The method ends when the IP address of the upstream recursive resolver used for data collection returned by each domain name query command is the same as the IP address of the target forwarder; Otherwise, the method ends when all the IP addresses of the upstream recursive resolvers used for data collection in the messages returned by each domain name query command are the same; Otherwise, the messages returned by each domain name query command are sorted in ascending order of the time when the domain name server received the domain name query command. Based on the sorting order, the TTL value of the resource record in the domain name query response corresponding to each message is obtained. When all TTL values show a linear decreasing trend and the version information in the messages returned by all version query commands is consistent, the caching mode of the target forwarder is independent caching. When all TTL values show multiple linear jumps and the version information in the messages returned by all version query commands is not completely consistent, the caching mode of the target forwarder is transparent mode. In the independent caching mode, the target forwarder maintains its own local domain name resource record cache copy; in the transparent caching mode, the target forwarder does not maintain a local domain name resource record cache copy.
2. The method as described in claim 1, characterized in that, All TTL values are fitted to a straight line, and the coefficient of determination obtained is R; R0 2 When the TTL value is ≥ 0.98 and the absolute deviation of all TTL values from the fitted straight line does not exceed ±1 TTL unit, it is determined that all TTL values show a linear decreasing trend.
3. The method as described in claim 2, characterized in that, The fitting method is the least squares method.
4. The method as described in claim 1, characterized in that, All TTL values are divided into several groups according to the upstream recursive resolver IP address in their corresponding packets, and the TTL values in each group are sorted according to the timestamp of the query processed by the resolver. The TTL value within each group shows a linear decreasing trend. When the difference between the first TTL values of different groups is greater than the first preset threshold, it is determined that all TTL values show a multi-linear jump.
5. The method as described in claim 4, characterized in that, The first preset threshold is 2 TTL units.
6. The method as described in claim 1, characterized in that, All TTL values are divided into several groups according to the upstream recursive resolver IP address in their corresponding packets, and the TTL values in each group are sorted according to the timestamp of the query processed by the resolver. When the TTL value within each group shows a linear decreasing trend and the rate of decrease of the representative TTL value is greater than the second preset threshold, it is determined that all TTL values exhibit a multi-linear jump. The representative TTL value is the first TTL value in the group.
7. The method according to any one of claims 1-6, characterized in that, Authoritative domain name servers are servers with full administrative privileges.
Citation Information
Patent Citations
Domain name resource record TTL tampering traceability positioning method based on analytic chain reasoning
CN121396674A