Counterfeit domain name detection method and system based on block chain technology

Abstract

The invention relates to the technical field of block chains, in particular to a counterfeit domain name detection method and system based on the block chain technology, and the method comprises the following steps: data collection, block chain construction, intelligent contract execution and application execution feedback. Data collection: collecting multi-source data such as DNS query logs, certificate transparency CT logs, user report information and third-party threat intelligence, including network flow collection, certificate log collection, user report collection and threat intelligence collection, and block chain construction: adopting a decentralized block chain architecture; based on the decentralized architecture of the block chain and the cross-mechanism cooperation capability of the smart contract, data sharing and cooperation processing between different mechanisms are promoted, and the security protection level of the whole network space is improved. Through application of a zero-knowledge proof technology, privacy protection of legality of domain name query by a user is realized, and leakage and abuse of user access records are avoided.

Description

Technical Field

[0001] This invention belongs to the field of blockchain technology, specifically relating to a method and system for detecting counterfeit domain names based on blockchain technology. Background Technology

[0002] With the rapid development of the internet, the Domain Name System (DNS), as one of the internet's infrastructures, is directly related to the stability of the entire cyberspace and the security of user information. However, the proliferation of spoofed domains (i.e., those that mimic legitimate domains to lure users to malicious websites, thereby committing fraud, stealing information, and other illegal activities) seriously threatens users' property security and personal privacy. To address this challenge, the industry has proposed various DNS anomaly detection methods, mainly including rule-based detection, statistics-based detection, machine learning-based detection, and behavior analysis-based detection.

[0003] Rule-based detection methods rely on predefined rule sets to match and analyze features such as domain name length, character set, and request frequency in DNS traffic. While simple to implement, this approach requires frequent rule base updates to address the ever-evolving DNS anomaly attacks and struggles to cover all new attack patterns.

[0004] Statistical detection methods identify abnormal behavior by analyzing the statistical characteristics of DNS traffic (such as request frequency and IP address distribution). However, because normal and abnormal traffic may overlap in their statistical features, this method is prone to false alarms, affecting detection accuracy.

[0005] Machine learning-based detection methods utilize machine learning algorithms to model DNS traffic and train models to identify abnormal patterns. While this method theoretically has high detection capabilities, it relies on a large amount of labeled data, and the model performance is significantly affected by algorithm selection and parameter tuning, making it difficult to adapt to rapidly changing network environments.

[0006] Behavioral analysis-based detection methods detect anomalies by analyzing DNS traffic behavior patterns (such as domain name resolution order and request time intervals). However, the effectiveness and real-time performance of this method are challenged when faced with complex DNS anomaly attacks, especially those that can simulate normal behavior patterns. Summary of the Invention

[0007] In view of the above situation, the present invention provides a method and system for detecting counterfeit domain names based on blockchain technology, which can solve the problems in the background technology above, including the following steps: data collection, blockchain construction, smart contract execution and application execution feedback; Data collection: Responsible for collecting multi-source data such as DNS query logs, certificate transparency (CT) logs, user reports, and third-party threat intelligence, including network traffic collection, certificate log collection, user report collection, and threat intelligence collection; Blockchain construction: Adopting a decentralized blockchain architecture to achieve immutable data storage and transparent sharing, including consensus mechanism design and data storage design; Smart contract execution: By automating the execution of smart contracts, human intervention is reduced, and detection efficiency and accuracy are improved, including counterfeit detection contracts and zero-knowledge verification contracts; Application execution feedback: The detection results of the blockchain layer are transformed into actual protection actions, realizing real-time interception of counterfeit domains and user warnings, providing a visual interface and reporting portal, enhancing user participation and system transparency, including real-time protection, user interaction, system management and cross-device collaboration.

[0008] Furthermore, the data collection includes network traffic collection: DNS query logs are collected in real time using traffic collection tools such as NetFlow / vFlow, and the Kafka cluster is used to realize real-time reception and processing of traffic, supporting a query rate of millions of QPS per second, ensuring efficient data transmission and storage; Certificate Log Collection: In cooperation with Certificate Authorities (CAs), we obtain Certificate Transparency (CT) logs. These logs contain key information such as the issuing authority of the certificate and its effective / expired time, which helps to verify the legitimacy of the domain name. Through a daily scheduled synchronization mechanism, we ensure the real-time performance and integrity of the data. User report collection: Develop browser plugins and other user-facing tools to encourage users to report counterfeit domains they discover. User reports serve as an important supplementary data source, helping to promptly identify new types of counterfeit domains. Reward mechanisms can be used to increase user participation and enthusiasm. Threat intelligence collection: Connect to third-party threat intelligence platforms such as VirusTotal to obtain the latest threat intelligence data, including information such as malicious IP addresses and malicious domains. This helps the system to detect and block potential spoofed domains in advance. Real-time data acquisition and updates are achieved through API interfaces.

[0009] Furthermore, the blockchain construction includes a consensus mechanism design: employing the dynamically weighted PBFT consensus algorithm to ensure data consistency and security. Verification nodes are composed of authoritative institutions such as CA organizations, browser vendors, and security vendors, and must stake a certain amount of ETH to qualify for participation in the consensus process. The dynamic weight calculation is based on two factors: the amount of staked tokens and historical accuracy. The top 21 nodes are selected as consensus nodes and the rest are observation nodes. The consensus process consists of three phases: the Pre-prepare phase, the Prepare phase, and the Commit phase, ensuring that data is agreed upon among all consensus nodes and stored on the blockchain.

[0010] Furthermore, the construction of the blockchain includes data storage design: to address the need for counterfeit domain name detection, three main data storage structures are designed: domain name blacklist, certificate fingerprint, and threat intelligence; The domain blacklist stores information such as the domain's SHA256 hash value (not plaintext), on-chain time, reporting node address, and evidence IPFS hash; the certificate fingerprint stores information such as the SHA256 fingerprint of the certificate's TBS portion, issuing authority ID, and effective / expired time; the threat intelligence stores information such as the IP address's SHA256 hash, reputation score, and threat tag array. This structured data facilitates efficient querying and processing by smart contracts, while also complying with data protection regulations such as GDPR.

[0011] Furthermore, the smart contract execution includes a counterfeit detection contract: responsible for the trusted detection and blacklist management of counterfeit domain names. The contract comprises three main parts: a node management mechanism, a TEE verification process, and blacklist management. The node management mechanism ensures that only high-quality nodes can participate in the detection and reporting of counterfeit domains by staking ETH and dynamically adjusting the accuracy rate. The TEE verification process uses AI models in the Trusted Execution Environment (TEE) to verify the submitted domain hashes and evidence, ensuring the accuracy and immutability of the detection results. The blacklist management is responsible for adding verified counterfeit domains to the blacklist and triggering corresponding blocking actions.

[0012] Furthermore, the smart contract execution includes a zero-knowledge verification contract: implementing privacy-protected domain name legitimacy verification; The contract consists of three main parts: proof generation, verification process, and proof registration mechanism. In the proof generation phase, users generate domain hashes and random nonces, and use zk-SNARK circuits to prove that "the domain is not in the blacklist"; the verification process includes two steps: validity verification and Merkle tree verification, to ensure the legality and validity of the proof; the proof registration mechanism is responsible for registering trusted institutions and dynamically updating the whitelist proofs, to ensure the flexibility and scalability of the system.

[0013] Furthermore, the application execution feedback includes four main aspects: real-time protection, user interaction, system management, and cross-device collaboration. Real-time protection: Multi-layered interception is achieved through browser plugins, DNS servers, and enterprise firewalls. When a user accesses a domain name, the browser plugin first checks the local cache. If no match is found, a zero-knowledge proof is generated to call the blockchain contract for verification. The DNS server monitors blockchain blacklist events in real time, updates the local cache, and returns a blocking address or warning page for suspicious domain names. The enterprise firewall subscribes to threat intelligence events, automatically generates and distributes firewall rules to block traffic and uploads audit logs to the blockchain. User interaction: Provides visual warnings and reporting channels to enhance user participation. Users can view warning information about counterfeit domains and report suspicious domains through browser plugins; system administrators can view detection results, manage blacklists, and adjust system parameters through the management interface. System Management: Automatically synchronizes policies, generates audit logs, and meets compliance requirements. System administrators can configure data collection policies, consensus mechanism parameters, and smart contract logic through the management interface. At the same time, the system automatically generates audit logs to record all operations and events, facilitating tracking and review. Cross-device collaboration: Covering all scenarios from end-user browsers, network layer DNS, and border firewalls, it achieves data sharing and collaborative processing through a unified blockchain platform, thereby improving the security protection capabilities of the entire cyberspace.

[0014] Furthermore, the system includes: The data acquisition module is responsible for collecting multi-source data such as DNS query logs, certificate transparency (CT) logs, user reports, and third-party threat intelligence, providing comprehensive and real-time data support for subsequent analysis. Blockchain module: Employs a decentralized blockchain architecture to achieve immutable data storage and transparent sharing. A consensus mechanism ensures data consistency and security, providing a trusted environment for smart contract execution. Smart contract module: As the core execution engine of the system, it is responsible for the trusted detection of counterfeit domain names, blacklist management, and cross-institutional collaboration. Through the automated execution of smart contracts, it reduces manual intervention and improves detection efficiency and accuracy. Application execution module: Transforms the detection results of the blockchain layer into actual protection actions, realizes real-time interception of counterfeit domains and user warnings, provides a visual interface and reporting portal, and enhances user participation and system transparency.

[0015] The method and system for detecting counterfeit domain names based on blockchain technology provided in this invention have the following significant advantages: Improved detection accuracy: By introducing blockchain technology and smart contracts, the immutability and transparency of data are achieved. Combined with multi-source data fusion and AI model analysis, the detection accuracy of counterfeit domain names is significantly improved.

[0016] Enhanced system security: By leveraging the consensus mechanism of blockchain and the automated execution of smart contracts, the risk of human intervention is reduced, while ensuring the security and reliability of the detection process.

[0017] Improved real-time performance and efficiency: Through real-time data acquisition and the design of efficient consensus algorithms, the system achieves rapid detection and interception of counterfeit domain names, effectively improving the system's real-time performance and processing efficiency.

[0018] Facilitating cross-institutional collaboration: The decentralized architecture of blockchain and the cross-institutional collaboration capabilities of smart contracts promote data sharing and collaborative processing among different institutions, thereby improving the overall security level of cyberspace.

[0019] Protecting user privacy: By applying zero-knowledge proof technology, privacy protection is achieved for the legitimacy of user domain queries, preventing the leakage and abuse of user access records. Attached Figure Description

[0020] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention.

[0021] Figure 1 This is a schematic diagram of the first embodiment of a method and system for detecting counterfeit domain names based on blockchain technology in this invention.

[0022] Figure 2 This is a schematic diagram of a second embodiment of a method and system for detecting counterfeit domain names based on blockchain technology in this invention. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0024] Those skilled in the art will understand that, unless specifically stated otherwise, the singular forms “a,” “an,” “the,” and “the” used herein may also include the plural forms. It should be further understood that the term “comprising” as used in this specification means the presence of features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0025] A method and system for detecting counterfeit domain names based on blockchain technology, such as Figure 1As shown, the process includes the following steps: data collection, blockchain construction, smart contract execution, and application execution feedback. Data collection: Responsible for collecting multi-source data such as DNS query logs, certificate transparency (CT) logs, user reports, and third-party threat intelligence, including network traffic collection, certificate log collection, user report collection, and threat intelligence collection; Blockchain construction: Adopting a decentralized blockchain architecture to achieve immutable data storage and transparent sharing, including consensus mechanism design and data storage design; Smart contract execution: By automating the execution of smart contracts, human intervention is reduced, and detection efficiency and accuracy are improved, including counterfeit detection contracts and zero-knowledge verification contracts; Application execution feedback: The detection results of the blockchain layer are transformed into actual protection actions, realizing real-time interception of counterfeit domains and user warnings, providing a visual interface and reporting portal, enhancing user participation and system transparency, including real-time protection, user interaction, system management and cross-device collaboration.

[0026] Specifically, this invention achieves data immutability and transparency by introducing blockchain technology and smart contracts, and significantly improves the accuracy of detecting counterfeit domain names by combining multi-source data fusion and AI model analysis.

[0027] In this embodiment, the data collection includes network traffic collection: DNS query logs are collected in real time using traffic collection tools such as NetFlow / vFlow, and the Kafka cluster is used to realize real-time reception and processing of traffic, supporting a query rate of millions of QPS per second, ensuring efficient data transmission and storage; Certificate Log Collection: In cooperation with Certificate Authorities (CAs), we obtain Certificate Transparency (CT) logs. These logs contain key information such as the issuing authority of the certificate and its effective / expired time, which helps to verify the legitimacy of the domain name. Through a daily scheduled synchronization mechanism, we ensure the real-time performance and integrity of the data. User report collection: Develop browser plugins and other user-facing tools to encourage users to report counterfeit domains they discover. User reports serve as an important supplementary data source, helping to promptly identify new types of counterfeit domains. Reward mechanisms can be used to increase user participation and enthusiasm. Threat intelligence collection: Connect to third-party threat intelligence platforms such as VirusTotal to obtain the latest threat intelligence data, including information such as malicious IP addresses and malicious domains. This helps the system to detect and block potential spoofed domains in advance. Real-time data acquisition and updates are achieved through API interfaces.

[0028] Specifically, by utilizing the consensus mechanism of blockchain and the automated execution of smart contracts, the risk of human intervention is reduced, while ensuring the security and reliability of the detection process.

[0029] In this embodiment, the construction of the blockchain includes a consensus mechanism design: the PBFT consensus algorithm with dynamic weights is adopted to ensure data consistency and security. Verification nodes are composed of authoritative institutions such as CA organizations, browser vendors, and security vendors, and must stake a certain amount of ETH to qualify for participation in the consensus process. The dynamic weight calculation is based on two factors: the amount of staked tokens and historical accuracy. The top 21 nodes are selected as consensus nodes and the rest are observation nodes. The consensus process consists of three phases: the Pre-prepare phase, the Prepare phase, and the Commit phase, ensuring that data is agreed upon among all consensus nodes and stored on the blockchain.

[0030] Specifically, this invention achieves rapid detection and interception of counterfeit domain names through real-time data acquisition and the design of an efficient consensus algorithm, effectively improving the system's real-time performance and processing efficiency.

[0031] In this embodiment, the data storage design included in the construction of the blockchain is as follows: To meet the needs of counterfeit domain name detection, three main data storage structures are designed: domain name blacklist, certificate fingerprint, and threat intelligence. The domain blacklist stores information such as the domain's SHA256 hash value (not plaintext), on-chain time, reporting node address, and evidence IPFS hash; the certificate fingerprint stores information such as the SHA256 fingerprint of the certificate's TBS portion, issuing authority ID, and effective / expired time; the threat intelligence stores information such as the IP address's SHA256 hash, reputation score, and threat tag array. This structured data facilitates efficient querying and processing by smart contracts, while also complying with data protection regulations such as GDPR.

[0032] Specifically, the decentralized architecture of blockchain and the cross-institutional collaboration capabilities of smart contracts promote data sharing and collaborative processing among different institutions, thereby improving the overall security level of cyberspace.

[0033] In this embodiment, the smart contract execution includes a counterfeit detection contract: responsible for the trusted detection and blacklist management of counterfeit domain names. The contract comprises three main parts: a node management mechanism, a TEE verification process, and a blacklist management system. The node management mechanism ensures that only high-quality nodes can participate in the detection and reporting of counterfeit domains by staking ETH and dynamically adjusting the accuracy rate. The TEE verification process uses AI models in the Trusted Execution Environment (TEE) to verify the submitted domain hashes and evidence, ensuring the accuracy and immutability of the detection results. The blacklist management is responsible for adding verified counterfeit domains to the blacklist and triggering corresponding blocking actions.

[0034] Specifically, by applying zero-knowledge proof technology, privacy protection is achieved for users querying the legitimacy of domain names, preventing the leakage and abuse of user access records.

[0035] In this embodiment, the smart contract executes a zero-knowledge verification contract to achieve privacy-protected domain name legitimacy verification. The contract consists of three main parts: proof generation, verification process, and proof registration mechanism. In the proof generation phase, users generate domain hashes and random nonces, and use zk-SNARK circuits to prove that "the domain is not in the blacklist"; the verification process includes two steps: validity verification and Merkle tree verification, to ensure the legality and validity of the proof; the proof registration mechanism is responsible for registering trusted institutions and dynamically updating the whitelist proofs, to ensure the flexibility and scalability of the system.

[0036] Specifically, rule-based methods have poor adaptability, statistical methods have a high false alarm rate, and machine learning-based methods are highly dependent on data and algorithms.

[0037] In this embodiment, the application execution feedback includes four main aspects: real-time protection, user interaction, system management, and cross-device collaboration. Real-time protection: Multi-layered interception is achieved through browser plugins, DNS servers, and enterprise firewalls. When a user accesses a domain name, the browser plugin first checks the local cache. If no match is found, a zero-knowledge proof is generated to call the blockchain contract for verification. The DNS server monitors blockchain blacklist events in real time, updates the local cache, and returns a blocking address or warning page for suspicious domain names. The enterprise firewall subscribes to threat intelligence events, automatically generates and distributes firewall rules to block traffic and uploads audit logs to the blockchain. User interaction: Provides visual warnings and reporting channels to enhance user participation. Users can view warning information about counterfeit domains and report suspicious domains through browser plugins; system administrators can view detection results, manage blacklists, and adjust system parameters through the management interface. System Management: Automatically synchronizes policies, generates audit logs, and meets compliance requirements. System administrators can configure data collection policies, consensus mechanism parameters, and smart contract logic through the management interface. At the same time, the system automatically generates audit logs to record all operations and events, facilitating tracking and review. Cross-device collaboration: Covering all scenarios from end-user browsers, network layer DNS, and border firewalls, it achieves data sharing and collaborative processing through a unified blockchain platform, thereby improving the security protection capabilities of the entire cyberspace.

[0038] Specifically, behavior-based methods struggle to cope with complex and ever-changing attack techniques. Furthermore, the use of a single data source limits the comprehensiveness and accuracy of detection, while the lack of cross-agency collaboration further weakens the overall effectiveness of the detection system.

[0039] In this embodiment, the system includes: The data acquisition module is responsible for collecting multi-source data such as DNS query logs, certificate transparency (CT) logs, user reports, and third-party threat intelligence, providing comprehensive and real-time data support for subsequent analysis. Blockchain module: Employs a decentralized blockchain architecture to achieve immutable data storage and transparent sharing. A consensus mechanism ensures data consistency and security, providing a trusted environment for smart contract execution. Smart contract module: As the core execution engine of the system, it is responsible for the trusted detection of counterfeit domain names, blacklist management, and cross-institutional collaboration. Through the automated execution of smart contracts, it reduces manual intervention and improves detection efficiency and accuracy. Application execution module: Transforms the detection results of the blockchain layer into actual protection actions, realizes real-time interception of counterfeit domains and user warnings, provides a visual interface and reporting portal, and enhances user participation and system transparency.

[0040] Specifically, regarding the hardware environment: select servers with high-performance computing capabilities and stable network connections as the blockchain node and smart contract execution environment. Simultaneously, ensure the necessary traffic acquisition tools and storage devices are available for the data acquisition layer.

[0041] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely preferred examples and are not intended to limit the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method and system for detecting counterfeit domain names based on blockchain technology, characterized in that, The method for detecting counterfeit domain names based on blockchain technology includes the following steps: data collection, blockchain construction, smart contract execution, and application execution feedback. Data collection: Responsible for collecting multi-source data such as DNS query logs, certificate transparency (CT) logs, user reports, and third-party threat intelligence, including network traffic collection, certificate log collection, user report collection, and threat intelligence collection; Blockchain construction: Adopting a decentralized blockchain architecture to achieve immutable data storage and transparent sharing, including consensus mechanism design and data storage design; Smart contract execution: By automating the execution of smart contracts, human intervention is reduced, and detection efficiency and accuracy are improved, including counterfeit detection contracts and zero-knowledge verification contracts; Application execution feedback: The detection results of the blockchain layer are transformed into actual protection actions, realizing real-time interception of counterfeit domains and user warnings, providing a visual interface and reporting portal, enhancing user participation and system transparency, including real-time protection, user interaction, system management and cross-device collaboration.

2. The method for detecting counterfeit domain names based on blockchain technology according to claim 1, characterized in that, The data collection includes network traffic collection: real-time collection of DNS query logs using traffic collection tools such as NetFlow / vFlow, and real-time reception and processing of traffic using a Kafka cluster, supporting a query rate of millions of QPS per second to ensure efficient data transmission and storage; Certificate Log Collection: In cooperation with Certificate Authorities (CAs), we obtain Certificate Transparency (CT) logs. These logs contain key information such as the issuing authority of the certificate and its effective / expired time, which helps to verify the legitimacy of the domain name. Through a daily scheduled synchronization mechanism, we ensure the real-time performance and integrity of the data. User report collection: Develop browser plugins and other user-facing tools to encourage users to report counterfeit domains they discover. User reports serve as an important supplementary data source, helping to promptly identify new types of counterfeit domains. Reward mechanisms can be used to increase user participation and enthusiasm. Threat intelligence collection: Connect to third-party threat intelligence platforms such as VirusTotal to obtain the latest threat intelligence data, including information such as malicious IP addresses and malicious domains. This helps the system to detect and block potential spoofed domains in advance. Real-time data acquisition and updates are achieved through API interfaces.

3. The method for detecting counterfeit domain names based on blockchain technology according to claim 1, characterized in that, The blockchain construction includes a consensus mechanism design: employing the dynamically weighted PBFT consensus algorithm to ensure data consistency and security. Verification nodes are composed of authoritative institutions such as CA organizations, browser vendors, and security vendors, and must stake a certain amount of ETH to qualify for participation in the consensus process. The dynamic weight calculation is based on two factors: the amount of staked tokens and historical accuracy. The top 21 nodes are selected as consensus nodes and the rest are observation nodes. The consensus process consists of three phases: the Pre-prepare phase, the Prepare phase, and the Commit phase, ensuring that data is agreed upon among all consensus nodes and stored on the blockchain.

4. The method for detecting counterfeit domain names based on blockchain technology according to claim 1, characterized in that, The construction of the blockchain includes data storage design: to meet the needs of counterfeit domain name detection, three main data storage structures are designed: domain name blacklist, certificate fingerprint, and threat intelligence; The domain blacklist stores information such as the domain's SHA256 hash value (not plaintext), on-chain time, reporting node address, and evidence IPFS hash; the certificate fingerprint stores information such as the SHA256 fingerprint of the certificate's TBS portion, issuing authority ID, and effective / expired time; the threat intelligence stores information such as the IP address's SHA256 hash, reputation score, and threat tag array. This structured data facilitates efficient querying and processing by smart contracts, while also complying with data protection regulations such as GDPR.

5. The method for detecting counterfeit domain names based on blockchain technology according to claim 1, characterized in that, The smart contract execution includes a counterfeit detection contract: responsible for the trusted detection and blacklist management of counterfeit domain names. The contract comprises three main parts: a node management mechanism, a TEE verification process, and blacklist management. The node management mechanism ensures that only high-quality nodes can participate in the detection and reporting of counterfeit domains by staking ETH and dynamically adjusting the accuracy rate. The TEE verification process uses AI models in the Trusted Execution Environment (TEE) to verify the submitted domain hashes and evidence, ensuring the accuracy and immutability of the detection results. The blacklist management is responsible for adding verified counterfeit domains to the blacklist and triggering corresponding blocking actions.

6. The method for detecting counterfeit domain names based on blockchain technology according to claim 1, characterized in that, The smart contract execution includes a zero-knowledge verification contract: implementing privacy-protected domain name legitimacy verification; The contract consists of three main parts: proof generation, verification process, and proof registration mechanism. In the proof generation phase, users generate domain hashes and random nonces, and use zk-SNARK circuits to prove that "the domain is not in the blacklist"; the verification process includes two steps: validity verification and Merkle tree verification, to ensure the legality and validity of the proof; the proof registration mechanism is responsible for registering trusted institutions and dynamically updating the whitelist proofs, to ensure the flexibility and scalability of the system.

7. The method for detecting counterfeit domain names based on blockchain technology according to claim 1, characterized in that, The application execution feedback includes four main aspects: real-time protection, user interaction, system management, and cross-device collaboration. Real-time protection: Multi-layered interception is achieved through browser plugins, DNS servers and enterprise firewalls. When a user accesses a domain name, the browser plugin first checks the local cache. If the cache is not found, a zero-knowledge proof is generated and the blockchain contract is called for verification. The DNS server monitors blockchain blacklist events in real time, updates its local cache, and returns blocking addresses or warning pages for suspicious domains; the enterprise firewall subscribes to threat intelligence events, automatically generates and distributes firewall rules to block traffic, and uploads audit logs to the blockchain. User interaction: Provides visual warnings and reporting channels to enhance user participation. Users can view warning information about counterfeit domains and report suspicious domains through browser plugins; system administrators can view detection results, manage blacklists, and adjust system parameters through the management interface. System Management: Automatically synchronizes policies, generates audit logs, and meets compliance requirements. System administrators can configure data collection policies, consensus mechanism parameters, and smart contract logic through the management interface. At the same time, the system automatically generates audit logs to record all operations and events, facilitating tracking and review. Cross-device collaboration: Covering all scenarios from end-user browsers, network layer DNS, and border firewalls, it achieves data sharing and collaborative processing through a unified blockchain platform, thereby improving the security protection capabilities of the entire cyberspace.

8. The counterfeit domain name detection system based on blockchain technology according to claim 1, characterized in that, The system includes: The data acquisition module is responsible for collecting multi-source data such as DNS query logs, certificate transparency (CT) logs, user reports, and third-party threat intelligence, providing comprehensive and real-time data support for subsequent analysis. Blockchain module: Employs a decentralized blockchain architecture to achieve immutable data storage and transparent sharing. A consensus mechanism ensures data consistency and security, providing a trusted environment for smart contract execution. Smart contract module: As the core execution engine of the system, it is responsible for the trusted detection of counterfeit domain names, blacklist management, and cross-institutional collaboration. Through the automated execution of smart contracts, it reduces manual intervention and improves detection efficiency and accuracy. Application execution module: Transforms the detection results of the blockchain layer into actual protection actions, realizes real-time interception of counterfeit domains and user warnings, provides a visual interface and reporting portal, and enhances user participation and system transparency.

Images