Request response method and device, equipment, storage medium and program product

Abstract

The invention relates to a request response method and device, equipment, a storage medium and a program product. The method comprises the following steps: for a received domain name query request, obtaining first associated data corresponding to an initiator of the domain name query request and second associated data corresponding to a server providing domain name service; providing the domain name query request, the first associated data and the second associated data to a preset analysis engine, performing security threat detection and server scheduling analysis of different dimensions by a plurality of analysis models included in the analysis engine, and integrating analysis results of the plurality of analysis models by a decision module included in the analysis engine, determining a target response strategy; and generating a request response result of the domain name query request based on the target response strategy. By adopting the method, the domain name request response security and response quality can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer networks, and in particular to a request response method and device, equipment, a storage medium and a program product. BACKGROUND

[0002] The current explosive growth of Internet of Things devices brings trillion-level DNS (Domain Name System) query requests per second. The existing DNS query request relies on recursive query, and its defense system is constructed based on a rule base and a blacklist. However, it cannot effectively cope with unknown threats and lacks adaptive ability. Its function is fixed after deployment, and it needs to rely on manual update of strategies and rule bases, which is costly and difficult to adapt to the rapidly changing network environment. Therefore, there is an urgent need for a domain name request response method to solve the above problems. SUMMARY

[0003] Therefore, it is necessary to provide a request response method, device, equipment, storage medium and program product capable of improving request response security in view of the above technical problems.

[0004] In a first aspect, the present application provides a request response method, comprising:

[0005] For the received domain name query request, obtaining first associated data corresponding to the initiator of the domain name query request, and second associated data corresponding to a service end providing domain name service;

[0006] Providing the domain name query request, the first associated data and the second associated data to a preset analysis engine, and performing security threat detection and service end scheduling analysis of different dimensions by a plurality of analysis models contained in the analysis engine, and determining a target response strategy by a decision module contained in the analysis engine based on the analysis results of the plurality of analysis models;

[0007] Based on the target response strategy, generating a request response result of the domain name query request.

[0008] In one embodiment, the first associated data includes behavior sequence data of the initiator of the domain name query request within a preset time period, and historical domain name query logs associated with the domain name query request; and the plurality of analysis models include a first analysis model for security threat detection in multiple dimensions.

[0009] The security threat detection includes:

[0010] Performing malicious domain name analysis by the first analysis model based on the domain name query request to obtain a domain name analysis result;

[0011] The first analysis model performs abnormal behavior analysis based on the behavior sequence data to obtain the abnormal behavior analysis results;

[0012] The first analysis model performs entity association analysis based on the behavior sequence data and the historical domain name query logs to obtain the association analysis results;

[0013] The first analysis model outputs security threat detection results based on the domain name analysis results, the abnormal behavior analysis results, and the correlation analysis results.

[0014] In one embodiment, the second associated data includes network performance data of the potential server and load metrics of the potential server; wherein, the potential server refers to a server that can provide address resolution services for the domain name requested by the domain name query request; the multiple analysis models include a second analysis model and a third analysis model, the second analysis model and the third analysis model being used for server scheduling analysis in different dimensions respectively;

[0015] The analysis of the server-side scheduling dimension includes:

[0016] The second analysis model performs performance prediction based on the network performance data of the potential servers to obtain the future network quality of each potential server; and,

[0017] The third analysis model performs load prediction based on the load indicators of the potential servers to obtain the future network load of each potential server.

[0018] In one embodiment, the decision module included in the analysis engine integrates the analysis results of multiple analysis models to determine the target response strategy, including:

[0019] If the security threat detection result indicates that the domain name query request is an abnormal request, the target response strategy is determined to be a security protection interception strategy.

[0020] If the security threat detection result indicates that the domain name query request is a normal request, the dynamic domain name resolution strategy is determined as the target response strategy based on the future quality of the network and the future load of the network.

[0021] In one embodiment, generating the request-response result for the domain name query request based on the target response strategy includes:

[0022] If the target response strategy is a security protection interception strategy, construct an abnormal domain name response code;

[0023] Based on the abnormal domain name response code, generate the request response result for the domain name query request;

[0024] If the target response strategy is a dynamic domain name resolution strategy, the target server is determined from the multiple potential servers;

[0025] Use the network address of the target server as the target network address of the domain name requested in the domain name query request;

[0026] Based on the target network address, generate the request response result for the domain name query request.

[0027] In one embodiment, generating the request response result for the domain name query request based on the target network address includes:

[0028] Based on the network stability of the target network address and the domain name change frequency of the domain name requested in the domain name query request, a dynamic lifetime is generated.

[0029] The target network address and the dynamic time to live are encapsulated to obtain the request response result of the domain name query request.

[0030] In one embodiment, after generating the request-response result of the domain name query request based on the target response strategy, the method further includes:

[0031] The request response result is sent to the party that initiated the domain name query request, and a request response log is generated;

[0032] The request response log is evaluated based on preset response evaluation indicators to obtain the evaluation results.

[0033] Based on the evaluation results, a reward signal is generated; wherein the reward signal is used to guide at least one model in the analysis engine to adjust its parameters.

[0034] Secondly, this application also provides a request-response device, comprising:

[0035] The data acquisition module is used to acquire, in response to a received domain name query request, first associated data corresponding to the initiator of the domain name query request and second associated data corresponding to the server providing the domain name service;

[0036] The analysis module is used to provide the domain name query request, the first associated data and the second associated data to a preset analysis engine. The analysis engine contains multiple analysis models to perform security threat detection and server scheduling analysis from different dimensions. The decision module contained in the analysis engine integrates the analysis results of multiple analysis models to determine the target response strategy.

[0037] The execution module is used to generate the request response result of the domain name query request based on the target response strategy.

[0038] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the above-described method.

[0039] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the above-described method.

[0040] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the above-described method.

[0041] The aforementioned request-response method, apparatus, device, storage medium, and program product, upon receiving a domain name query request, proactively acquires first associated data corresponding to the initiator of the domain name query request and second associated data corresponding to the server providing the domain name service. The first associated data allows analysis of the initiator of the domain name query request, while the second associated data allows analysis of the current network topology. This enables the use of multiple analysis models within the analysis engine to perform security threat detection and server-side scheduling analysis from multiple dimensions. Finally, the decision module within the analysis engine integrates the analysis results of multiple analysis models to determine the target response strategy. Based on the target response strategy, a request-response result for the domain name query request is generated. Through multi-dimensional security threat detection, the response security of the domain name query request can be improved, and through multi-dimensional server-side scheduling analysis, dynamic processing of the domain name query request can be achieved. Attached Figure Description

[0042] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0043] Figure 1 This is a diagram illustrating the application environment of a request-response method in one embodiment;

[0044] Figure 2 This is a flowchart illustrating a request-response method in one embodiment;

[0045] Figure 3 This is a flowchart illustrating the security threat detection process involved in step 204 of one embodiment;

[0046] Figure 4This is a system architecture diagram of a request-response method in one embodiment;

[0047] Figure 5 This is a flowchart illustrating the application of a request-response method in one embodiment;

[0048] Figure 6 This is a structural block diagram of a request-response device in one embodiment;

[0049] Figure 7 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0051] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0052] The request-response method provided in this application embodiment can be applied to, for example... Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104, or it can be located in the cloud or on another network server.

[0053] Terminal 102 can initiate a domain name query request to server 104. After receiving the domain name query request, server 104 generates a request response result for the domain name query request by executing the request response method provided in this application, and returns the request response result to terminal 102.

[0054] Terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, drones, low-altitude aircraft, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, and projection equipment. Portable wearable devices can include smartwatches, smart bracelets, and head-mounted displays. Head-mounted displays can be virtual reality (VR) devices, augmented reality (AR) devices, and smart glasses. Server 104 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0055] In one exemplary embodiment, such as Figure 2 As shown, a request-response method is provided, which is applied to... Figure 1 Taking the server in the example, the explanation includes the following steps 202 to 206. Wherein:

[0056] Step 202: For the received domain name query request, obtain the first associated data corresponding to the initiator of the domain name query request and the second associated data corresponding to the server providing the domain name service.

[0057] Among them, a domain name query request, also known as a DNS query request, is a query request initiated to convert a domain name into a server's network address (i.e., IP address); further, the initiator of a domain name query request refers to the terminal that actively initiates the domain name query request.

[0058] It is understandable that a domain name query request will at least contain the domain name that needs to be queried.

[0059] In some embodiments, the first associated data corresponding to the initiator of the domain name query request may include data directly associated with the initiator of the domain name query request, such as the initiator's network status data, request logs, etc.; it may also include other data indirectly associated with the initiator of the domain name query request, such as the network environment data of the initiator of the domain name query request, other network access data within the same time period of the domain name query request, etc.

[0060] In some embodiments, when a domain name query request is received, the first associated data and the second associated data can be actively probed through a traffic probe or a preset application programming interface (API).

[0061] In other embodiments, after obtaining the first and second associated data, data preprocessing can be performed on the first and second associated data to facilitate subsequent data analysis by the analysis engine; wherein, data preprocessing can be data cleaning, data standardization, etc.

[0062] Step 204: The domain name query request, the first associated data and the second associated data are provided to the preset analysis engine. The analysis engine contains multiple analysis models to perform security threat detection and server scheduling analysis from different dimensions. The decision module contained in the analysis engine integrates the analysis results of multiple analysis models to determine the target response strategy.

[0063] The preset analysis engine includes multiple analysis models and a decision module. Furthermore, different analysis models can be used to achieve different analysis tasks, and different analysis models can also be used together to achieve the same analysis task, without specific restrictions. The decision module is used to integrate the analysis results of multiple analysis models to determine the target response strategy.

[0064] In some embodiments, security threat detection is used to detect whether a domain name query request is a malicious domain name request. Furthermore, malicious domain name requests can be judged from multiple different dimensions. For example, if the queried domain name is confirmed to be a malicious domain name, the domain name query request can be considered a malicious domain name request. Alternatively, if the queried domain name is not a malicious domain name, but the request behavior conforms to an abnormal pattern, such as being a high-frequency burst request or a query from a high-risk area, the domain name query request can also be considered a malicious domain name request.

[0065] In some embodiments, server-side scheduling analysis refers to analyzing the servers that can provide address resolution services for the domain name requested by the domain name query request, thereby determining one or more optimal servers to provide address resolution services for the current domain name query request.

[0066] In some embodiments, server-side scheduling analysis may include server-side network quality analysis, load analysis, resource availability analysis, geographic location analysis, etc.

[0067] Understandably, different target response strategies determine the response process and results of domain name query requests.

[0068] Step 206: Based on the target response strategy, generate the request and response results for the domain name query request.

[0069] In some embodiments, the request response result can be divided into a successful response result and a failed response result; wherein, the successful response result includes at least the target network address of the domain name requested by the domain name query request.

[0070] Furthermore, based on the successful response result, by returning the request response result to the party that initiated the domain name query request, the party can access the domain name through the target network address contained in the request response result.

[0071] The aforementioned request-response method, apparatus, computer device, and readable storage medium, upon receiving a domain name query request, proactively acquire first associated data corresponding to the initiator of the domain name query request and second associated data corresponding to the server providing the domain name service. The first associated data allows analysis of the initiator of the domain name query request, while the second associated data allows analysis of the current network topology. This enables the use of multiple analysis models within the analysis engine to perform security threat detection and server-side scheduling analysis from multiple dimensions. Finally, the decision module within the analysis engine integrates the analysis results of multiple analysis models to determine a target response strategy. Based on the target response strategy, a request-response result for the domain name query request is generated. Through multi-dimensional security threat detection, the response security of the domain name query request can be improved, and through multi-dimensional server-side scheduling analysis, dynamic processing of the domain name query request can be achieved.

[0072] In one exemplary embodiment, such as Figure 3 As shown, the first associated data includes the behavioral sequence data of the initiator of the domain name query request within a preset time period, and historical domain name query logs associated with the domain name query request; multiple analysis models include a first analysis model, which is used for multi-dimensional security threat detection; security threat detection in step 204 includes steps 302 to 308. Wherein:

[0073] Step 302: The first analysis model performs malicious domain name analysis based on the domain name query request to obtain the domain name analysis results.

[0074] In some embodiments, the first analysis model may include multiple sub-models, with different sub-models used to perform different security threat detection tasks; finally, the security threat detection results of the first analysis model are output based on the task execution results of each sub-model.

[0075] Among them, malicious domain name analysis analyzes the domain name itself requested in the domain name query request; it focuses on the linguistic features of the domain name itself and is used to detect malicious domain names generated by botnet algorithms.

[0076] Specifically, the first analysis model preprocesses the domain name query request by extracting the requested domain name from the domain name query request message and removing the top-level domain; then, it converts the domain name string into numerical features that the model can process, i.e., feature vectorization; the first analysis model outputs the probability that the domain name requested by the domain name query request is a malicious domain name.

[0077] The first analysis model may include a binary classification model obtained through supervised training; further, the training samples of the binary classification model include a large number of legitimate domain names and malicious domain names, and its output includes two types: normal domain names and abnormal domain names.

[0078] Step 304: The first analysis model performs abnormal behavior analysis based on the behavior sequence data to obtain the abnormal behavior analysis results.

[0079] Among them, abnormal behavior analysis focuses on analyzing the initiator's anomalies in the time series, rather than being limited to a single query.

[0080] In some embodiments, the behavioral sequence data of the initiator of the domain name query request within a preset time period can be obtained by querying the initiator's request log.

[0081] Understandably, by analyzing the initiator's behavioral sequence data within a preset time period, we can obtain information such as the initiator's request frequency, query entropy, the proportion of non-existent query domains, and the distribution of query types within that time period. This allows us to infer whether the initiator exhibits abnormal behavior. If the initiator exhibits abnormal behavior, the domain query requests issued by that initiator are also likely to be abnormal requests.

[0082] Specifically, the first analysis model extracts features from the behavioral sequence data to obtain temporal features. Then, it uses the temporal features to perform abnormal behavior analysis and obtain the abnormal behavior analysis results.

[0083] In some embodiments, the first analysis model may include a deep learning model combining a long short-term memory network and an autoencoder; wherein the deep learning model is trained using a large amount of normal behavioral sequence data, and the deep learning model can reconstruct behavioral patterns based on normal behavioral sequence data, and then output an anomaly score of the reconstructed behavioral pattern, representing the degree to which the current behavior deviates from the historical normal baseline; when the input is abnormal behavioral sequence data, the deep learning model cannot accurately reconstruct it, and thus produces a high anomaly score.

[0084] Step 306: The first analysis model performs entity association analysis based on behavioral sequence data and historical domain name query logs to obtain the association analysis results.

[0085] Among them, the historical domain name query log associated with the domain name query request refers to the log formed by all domain name query requests from different initiators processed within a preset time period before the domain name query request is received; furthermore, the historical domain name query log can include not only the response logs of the domain name query requests of each initiator, but also the network configuration information of each initiator.

[0086] Entity association refers to the relationship between different initiators. It can be understood that potential malicious clusters can be discovered through entity association analysis. For example, if two different initiators have registered the same email address, and one initiator makes a malicious domain query request, then the request made by the other initiator associated with it is also highly likely to be a malicious domain request.

[0087] In some embodiments, the historical domain name query log includes content such as the initiator's network address, the requested domain name, the resolved target address, the registered email address, etc. When performing entity association analysis, the association between various contents is first constructed, such as the association between the initiator's network address-query-domain name, domain name-resolved target address, domain name-registrant-email address, etc. Then, the entity association analysis is performed using the graph convolution method, and finally the association risk score between different entities is output to obtain the association analysis results.

[0088] Step 308: The first analysis model outputs security threat detection results based on the domain name analysis results, abnormal behavior analysis results, and correlation analysis results.

[0089] In some embodiments, a first score may be determined based on the confidence level of the domain name analysis results, a second score may be determined based on the abnormal score of the abnormal behavior analysis results, and a third score may be determined based on the correlation analysis results. Then, the first score, the second score, and the third score are weighted and summed to obtain a security threat detection score. If the security threat detection score is higher than a preset score threshold, the security threat detection result indicates that the domain name query request is an abnormal request; otherwise, the security threat detection result indicates that the domain name query request is a normal request.

[0090] In the above embodiments, cross-detection of domain name query requests through three dimensions greatly improves the detection rate and accuracy of unknown and covert attacks.

[0091] It should be noted that the three-dimensional detections performed by the first analysis model can be executed by different network modules included in the first analysis model, where each network module is trained specifically using corresponding training samples.

[0092] In an exemplary embodiment, the second associated data includes network performance data and load metrics of the potential server; wherein, the potential server refers to a server capable of providing address resolution services for the domain name requested by the domain name query request; multiple analysis models include a second analysis model and a third analysis model, which are used for server scheduling analysis in different dimensions; the analysis of the server scheduling dimension in step 204 includes steps 402 to 404. Wherein:

[0093] Step 402: The second analysis model performs performance prediction based on the network performance data of potential servers to obtain the future network quality of each potential server.

[0094] The screening process for potential servers includes: first, querying the domain's authoritative records to obtain a list of servers; then, dynamically expanding the server list through API integration with cloud platforms, CDNs (Content Delivery Networks), and edge nodes to include service nodes closer to users; and finally, performing preliminary filtering on the server list based on real-time load metrics to remove overloaded servers, resulting in a set of potential servers.

[0095] Among them, the network performance data of the potential server is used to describe network stability, such as network latency, jitter, and packet loss rate.

[0096] Network future quality is used to describe the stability of the network on the server side over a period of time in the future; further, network future quality can be a specific quality score or an abstract quality representation, such as high quality, low quality, etc.

[0097] Step 404: The third analysis model performs load prediction based on the load indicators of potential servers to obtain the future network load of each potential server.

[0098] Among them, the load metrics of the potential server are indicators used to describe the load situation of the server, such as memory size, current number of connections, central controller parameters, etc.

[0099] Network future load is used to describe the network load of a server over a period of time in the future; further, network future load can be a specific load score or an abstract load representation, such as high load, low load, etc.

[0100] In this embodiment, by performing performance and load prediction on potential servers, the optimal server can be selected to respond to domain name query requests based on the future quality and load of the network, thereby improving the response efficiency and quality of domain name query requests.

[0101] In an exemplary embodiment, in step 204, the decision module included in the analysis engine integrates the analysis results of multiple analysis models to determine the target response strategy, including steps 502 to 504. Wherein:

[0102] Step 502: If the security threat detection result indicates that the domain name query request is an abnormal request, determine the target response strategy as a security protection interception strategy.

[0103] Specifically, the security protection and interception strategy includes isolating domain name query requests, interrupting the query process of domain name query requests, and directly returning that the domain name does not exist.

[0104] Step 504: If the security threat detection result indicates that the domain name query request is a normal request, determine the dynamic domain name resolution strategy as the target response strategy based on the future quality of the network and the future load of the network.

[0105] Among them, the dynamic domain name resolution strategy is a set of strategies that include multiple resolution strategies; further, when determining the dynamic domain name resolution strategy as the target response strategy, one of the multiple resolution strategies included in the dynamic domain name resolution strategy is selected for domain name resolution based on the network's future quality and future load.

[0106] In some embodiments, the dynamic domain name resolution strategy may include an optimal path selection strategy and a load balancing strategy. If, based on the future network quality of each potential server, it is determined that there is a server that meets the preset network quality conditions, and based on the future network load of each potential server, it is determined that the load difference between each potential server is within a preset range, then the optimal path selection strategy can be selected; otherwise, the load balancing strategy is selected.

[0107] By combining the analysis results of multiple analysis models through the above implementation methods, the target response strategy is determined, and the problems of defense against unknown attacks and network optimization scheduling are solved simultaneously, achieving the effects of proactive security and precise scheduling.

[0108] In an exemplary embodiment, step 206 may include steps 602 to 610. Wherein:

[0109] Step 602: If the target response strategy is a security protection interception strategy, construct the abnormal domain name response code.

[0110] Specifically, an abnormal domain response code "NXDOMAIN" is constructed, which means that the queried domain does not exist, thereby interrupting the domain query.

[0111] Step 604: Based on the abnormal domain name response code, generate the request response result for the domain name query request.

[0112] Specifically, the abnormal domain response code and other response information (such as timestamps, error descriptions, etc.) are structured and encapsulated to obtain the request response result of the domain query request.

[0113] Step 606: If the target response strategy is a dynamic domain name resolution strategy, determine the target server from multiple potential servers.

[0114] For example, taking dynamic domain name resolution strategies including optimal path selection strategy and load balancing strategy as an example, if the target response strategy is the optimal path selection strategy in the dynamic domain name resolution strategy, the server with the highest future network quality is selected from multiple potential servers as the target server, thereby providing a fast access experience; if the target response strategy is the load balancing strategy in the dynamic domain name resolution strategy, the server with the lowest future network load is selected from multiple potential servers as the target server, in order to balance the stability of the server cluster.

[0115] Step 608: Use the network address of the target server as the target network address of the domain name requested in the domain name query request.

[0116] Step 610: Based on the target network address, generate the request and response results for the domain name query request.

[0117] Specifically, the target network address and other response information (such as timestamps, time to live, response codes, etc.) are encapsulated in a structured manner to obtain the request and response results of the domain name query request.

[0118] In the above embodiments, request responses are based on different target response strategies, which can achieve multi-dimensional intelligent processing of domain name query requests.

[0119] In an exemplary embodiment, step 610 may include steps 702 to 704. Wherein:

[0120] Step 702: Generate a dynamic lifetime based on the network stability of the target network address and the domain name change frequency of the domain name requested in the domain name query request.

[0121] Domain name change frequency refers to how frequently the network address mapped to a domain name changes; it measures the stability and dynamism of the service behind the domain name.

[0122] In some embodiments, the frequency of domain name changes can be calculated by continuously tracking and analyzing the historical resolution records of a domain name and counting the number of times its network address changes within a sliding time window.

[0123] Dynamic lifetime is used to limit the validity period of the content in the request response result. After the dynamic lifetime expires, the content in the request response result becomes invalid, thereby forcing the client to initiate a new query as soon as possible to obtain the latest address.

[0124] Specifically, the higher the network stability and the lower the frequency of domain name changes in the domain name query request, the more stable the server and target network address that the domain name points to, and therefore the longer the generated dynamic lifetime; otherwise, the generated dynamic lifetime is shorter.

[0125] Step 704: Encapsulate the target network address and dynamic time to live to obtain the request response result of the domain name query request.

[0126] Specifically, the target network address, dynamic generation time, and other response information (such as timestamp, time to live, response code, etc.) are structured and encapsulated to obtain the request and response results of the domain name query request.

[0127] In the above embodiments, a dynamic lifetime is generated based on the network stability of the target network address and the frequency of domain name changes of the domain name requested in the domain name query request. This can provide a longer lifetime for stable domain names and network addresses, reducing the number of accesses and lowering network load; and provide a shorter lifetime for frequently changing domain names and unstable network addresses, forcing the client to initiate a new query as soon as possible to obtain the latest address, avoiding access interruption, and ensuring access continuity.

[0128] In an exemplary embodiment, after step 206, the request-response method may further include steps 802 to 806. Wherein:

[0129] Step 802: Send the request response result to the party that initiated the domain name query request and generate a request response log.

[0130] The request response log can include information such as request latency, data throughput, request results, and bandwidth utilization.

[0131] Step 804: Evaluate the request response log based on preset response evaluation indicators to obtain the evaluation results.

[0132] In some embodiments, the preset response evaluation metrics may include security response metrics, user experience metrics, and system efficiency metrics; wherein, security response metrics may include whether the response was successful, whether a response was made to a malicious domain name request, and whether access to a normal query request was denied; user experience metrics may include response latency rate, response error rate, and data throughput; system efficiency metrics may include server scheduling efficiency, load balancing, and network bandwidth utilization.

[0133] Step 806: Based on the evaluation results, generate a reward signal; wherein the reward signal is used to guide at least one model in the analysis engine to adjust its parameters.

[0134] In some embodiments, the parameters of the analysis model in the analysis engine can be adjusted, the parameters of the decision module in the analysis engine can be adjusted, or the parameters of both the analysis model and the decision module in the analysis engine can be adjusted simultaneously.

[0135] For example, if the evaluation result indicates that the request response result meets the preset response evaluation index, a first reward signal is generated to strengthen the decision module in the analysis engine; if the evaluation result indicates that the request response result responded to the malicious domain name request, a second reward signal can be generated to guide the parameter adjustment of the first analysis model in the analysis engine; if the evaluation result indicates that the request response result is unbalanced, a third reward signal can be generated to guide the parameter adjustment of the third analysis model in the analysis engine, etc.

[0136] In the above embodiments, reward signals are used to guide the analysis engine to continuously learn and optimize, enabling the analysis engine to continuously evolve and significantly reducing the reliance on manual operation and maintenance.

[0137] Please see Figure 4 , Figure 4 A system architecture diagram of the request-response method according to an embodiment of this application is shown. It includes a management console, a data acquisition unit, an analysis engine unit, and an execution unit. Wherein:

[0138] The management console allows for the monitoring, configuration, and management of various functional units through a visual interface; for example, configuring response strategies and conducting manual reviews.

[0139] The data acquisition unit is used to collect various types of data, including the first and second associated data involved in the above embodiments. For example, it can use a DNS traffic probe to detect information about recursive or authoritative servers, obtain information such as bandwidth, latency, and load through a network performance monitor, and subscribe to threat intelligence through an external API interface.

[0140] In some embodiments, the acquired raw data stream is stored in a message queue and processed through a pre-defined processing flow to obtain a standard data stream, which is then input into the analysis engine unit.

[0141] The analysis engine unit is used to analyze standard data streams and output decision instructions. Specifically, the analysis engine unit may include a security threat detection model, i.e., the first analysis model, used for anomaly detection, domain name DGA identification, and GNN graph analysis; it may also include a performance prediction and scheduling model, i.e., the second analysis model, the third analysis model, and the decision module in the above embodiments, used for network prediction and decision optimization. In addition, the analysis engine unit may also include a cache management model for managing cached data; and a model training and update platform for adjusting the models in the analysis engine based on reward signals.

[0142] The execution unit is used to execute the target response strategy output by the analysis engine unit. Specifically, the execution unit may include an intelligent scheduling unit and a secure execution unit; the intelligent scheduling unit is used to return the optimal network address according to the target response strategy when the domain name query request is normal; the secure execution unit is used to return a query failure or redirection when the domain name query request is abnormal.

[0143] Finally, the analysis engine unit generates the request-response result based on the execution result of the execution unit, and then performs the request-response.

[0144] Please see Figure 5 , Figure 5 An application flowchart of the request-response method according to an embodiment of this application is shown.

[0145] When a domain name query request is received, it is determined whether intelligent DNS resolution needs to be enabled. If not, the request is responded to using the method described in this application. If not, conventional DNS processing methods, i.e., recursive querying, are used. If so, real-time data collection is initiated. This determination can be made manually or based on preset policy rules. For example, if the domain name query request occurs during peak access times, intelligent DNS resolution is enabled; otherwise, conventional DNS processing is used.

[0146] After real-time data acquisition, network status detection, server load monitoring, and security threat scanning are performed. Specifically, the collected data undergoes feature engineering processing, followed by analysis and detection by network health assessment models, attack threat prediction models, and server load prediction models. Finally, a target response strategy is output based on the detection results from multiple analysis models.

[0147] The target response strategy includes three types: optimal path, which selects the server with the lowest latency; security protection, which isolates malicious requests and returns a non-existent domain name; and load balancing, which adjusts the weight of each server and updates DNS records.

[0148] Then, when it is necessary to return the target network address, a dynamic TTL (Time To Live) is generated based on the network stability of the target network address and the frequency of domain name changes of the domain name requested in the domain name query request, and the resolution result is returned.

[0149] Finally, user response data is recorded and performance is evaluated. If the performance meets the standards, the analysis model is strengthened, i.e., reinforcement learning rewards are applied. If the performance does not meet the standards, the analysis engine is optimized by adjusting parameters, and the optimized analysis engine is redeployed into the application process through an online knowledge base.

[0150] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0151] Based on the same inventive concept, this application also provides a request response apparatus for implementing the request response method described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations in one or more request response apparatus embodiments provided below can be found in the limitations of the request response method described above, and will not be repeated here.

[0152] In one exemplary embodiment, such as Figure 6 As shown, a request-response device is provided, comprising:

[0153] The data acquisition module is used to obtain, in response to a received domain name query request, the first associated data corresponding to the initiator of the domain name query request and the second associated data corresponding to the server providing the domain name service;

[0154] The analysis module provides the domain name query request, first associated data and second associated data to the preset analysis engine. The analysis engine contains multiple analysis models to perform security threat detection and server-side scheduling analysis from different dimensions. The decision module in the analysis engine integrates the analysis results of multiple analysis models to determine the target response strategy.

[0155] The execution module is used to generate the request and response results of the domain name query request based on the target response strategy.

[0156] In one embodiment, the first associated data includes behavioral sequence data of the initiator of the domain name query request within a preset time period, and historical domain name query logs associated with the domain name query request; multiple analysis models include a first analysis model, which is used for multi-dimensional security threat detection; the analysis module is specifically used to perform malicious domain name analysis based on the domain name query request by the first analysis model to obtain domain name analysis results; to perform abnormal behavior analysis based on the behavioral sequence data by the first analysis model to obtain abnormal behavior analysis results; to perform entity association analysis based on the behavioral sequence data and historical domain name query logs by the first analysis model to obtain association analysis results; and to output security threat detection results based on the domain name analysis results, abnormal behavior analysis results, and association analysis results by the first analysis model.

[0157] In one embodiment, the second associated data includes network performance data and load metrics of potential servers; wherein, a potential server refers to a server capable of providing address resolution services for the domain name requested by the domain name query request; the multiple analysis models include a second analysis model and a third analysis model, which are used for server scheduling analysis in different dimensions; the analysis module is specifically used to perform performance prediction based on the network performance data of potential servers by the second analysis model to obtain the future network quality of each potential server; and to perform load prediction based on the load metrics of potential servers by the third analysis model to obtain the future network load of each potential server.

[0158] In one embodiment, the analysis module is further configured to determine the target response strategy as a security protection interception strategy if the security threat detection result indicates that the domain name query request is an abnormal request; and to determine the dynamic domain name resolution strategy as the target response strategy based on the future network quality and future network load if the security threat detection result indicates that the domain name query request is a normal request.

[0159] In one embodiment, the execution module is configured to: construct an abnormal domain name response code if the target response policy is a security protection interception policy; generate a request response result for the domain name query request based on the abnormal domain name response code; determine the target server from multiple potential servers if the target response policy is a dynamic domain name resolution policy; use the network address of the target server as the target network address of the domain name requested by the domain name query request; and generate a request response result for the domain name query request based on the target network address.

[0160] In one embodiment, the execution module is specifically used to generate a dynamic lifetime based on the network stability of the target network address and the frequency of domain name changes of the domain name requested in the domain name query request; and to encapsulate the target network address and the dynamic lifetime to obtain the request response result of the domain name query request.

[0161] In one embodiment, the request response device further includes a response module, which is used to send the request response result to the initiator of the domain name query request and generate a request response log; evaluate the request response log based on a preset response evaluation index to obtain an evaluation result; and generate a reward signal based on the evaluation result; wherein the reward signal is used to guide at least one model in the analysis engine to adjust its parameters.

[0162] Each module in the aforementioned request-response device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can invoke and execute the operations corresponding to each module.

[0163] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 7 As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores requested data. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When executed by the processor, the computer program implements a request-response method.

[0164] Those skilled in the art will understand that Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0165] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the method described above.

[0166] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of the above-described method.

[0167] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the method described above.

[0168] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0169] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0170] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0171] The above embodiments are merely illustrative of several implementation methods of this application, and their descriptions are relatively specific and detailed. However, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A request-response method, characterized in that, The method includes: For a received domain name query request, obtain the first associated data corresponding to the initiator of the domain name query request and the second associated data corresponding to the server providing the domain name service; The domain name query request, the first associated data, and the second associated data are provided to a preset analysis engine. The analysis engine contains multiple analysis models that perform security threat detection and server scheduling analysis from different dimensions. The decision module contained in the analysis engine integrates the analysis results of multiple analysis models to determine the target response strategy. Based on the target response strategy, the request response result of the domain name query request is generated.

2. The method according to claim 1, characterized in that, The first associated data includes the behavior sequence data of the initiator of the domain name query request within a preset time period, and historical domain name query logs associated with the domain name query request; The plurality of analysis models include a first analysis model, which is used for security threat detection in multiple dimensions; The security threat detection includes: The first analysis model performs malicious domain name analysis based on the domain name query request to obtain the domain name analysis results; The first analysis model performs abnormal behavior analysis based on the behavior sequence data to obtain the abnormal behavior analysis results; The first analysis model performs entity association analysis based on the behavior sequence data and the historical domain name query logs to obtain the association analysis results; The first analysis model outputs security threat detection results based on the domain name analysis results, the abnormal behavior analysis results, and the correlation analysis results.

3. The method according to claim 1, characterized in that, The second associated data includes network performance data and load metrics of the potential server; wherein, the potential server refers to a server that can provide address resolution services for the domain name requested by the domain name query request; The multiple analysis models include a second analysis model and a third analysis model, which are used for server-side scheduling analysis from different dimensions. The analysis of the server-side scheduling dimension includes: The second analysis model performs performance prediction based on the network performance data of the potential servers to obtain the future network quality of each potential server; and, The third analysis model performs load prediction based on the load indicators of the potential servers to obtain the future network load of each potential server.

4. The method according to claim 3, characterized in that, The decision module included in the analysis engine integrates the analysis results of multiple analysis models to determine the target response strategy, including: If the security threat detection result indicates that the domain name query request is an abnormal request, the target response strategy is determined to be a security protection interception strategy. If the security threat detection result indicates that the domain name query request is a normal request, the dynamic domain name resolution strategy is determined as the target response strategy based on the future quality of the network and the future load of the network.

5. The method according to claim 4, characterized in that, The step of generating the request and response result for the domain name query request based on the target response strategy includes: If the target response strategy is a security protection interception strategy, construct an abnormal domain name response code; Based on the abnormal domain name response code, generate the request response result for the domain name query request; If the target response strategy is a dynamic domain name resolution strategy, the target server is determined from among the multiple potential servers; Use the network address of the target server as the target network address of the domain name requested in the domain name query request; Based on the target network address, generate the request response result for the domain name query request.

6. The method according to claim 5, characterized in that, The step of generating the request response result for the domain name query request based on the target network address includes: Based on the network stability of the target network address and the domain name change frequency of the domain name requested in the domain name query request, a dynamic lifetime is generated. The target network address and the dynamic time to live are encapsulated to obtain the request response result of the domain name query request.

7. The method according to any one of claims 1-6, characterized in that, After generating the request-response result for the domain name query request based on the target response strategy, the method further includes: The request response result is sent to the party that initiated the domain name query request, and a request response log is generated; The request response log is evaluated based on preset response evaluation indicators to obtain the evaluation results. Based on the evaluation results, a reward signal is generated; wherein the reward signal is used to guide at least one model in the analysis engine to adjust its parameters.

8. A request-response device, characterized in that, The device includes: The data acquisition module is used to acquire, in response to a received domain name query request, first associated data corresponding to the initiator of the domain name query request and second associated data corresponding to the server providing the domain name service; The analysis module is used to provide the domain name query request, the first associated data and the second associated data to a preset analysis engine. The analysis engine contains multiple analysis models to perform security threat detection and server scheduling analysis from different dimensions. The decision module contained in the analysis engine integrates the analysis results of multiple analysis models to determine the target response strategy. The execution module is used to generate the request response result of the domain name query request based on the target response strategy.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images