Domain name analysis method, device, system and equipment

Abstract

The invention relates to a domain name analysis method, device, system and equipment. The method is applied to a first-level cluster, and comprises the following steps: obtaining network flow message data corresponding to a network flow; forwarding the network flow message data to a secondary cluster according to a message forwarding strategy; wherein the network flow message data is used for indicating the secondary cluster to perform domain name resolution processing on the network flow message data to obtain domain name information. According to the invention, the domain name extraction efficiency can be effectively improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a domain name analysis method, apparatus, system and device. Background Technology

[0002] In network traffic, domain names serve as key information for identifying and locating internet resources. Their extraction and resolution play a crucial role in network security management tasks such as network monitoring, access control, and content filtering.

[0003] Traditional domain name analysis methods mainly rely on analyzing and processing data packets in network traffic one by one to identify domain name information in the data packets.

[0004] However, the network traffic processing architecture corresponding to traditional domain name analysis methods is difficult to cope with the dynamic changes and fluctuations of large-scale network traffic in practical applications, thus affecting the efficiency of domain name extraction. Summary of the Invention

[0005] Therefore, it is necessary to provide a domain name analysis method, apparatus, system, and equipment that can effectively extract domain names and address the aforementioned technical problems.

[0006] Firstly, this application provides a domain name analysis method applied to a primary cluster, the method comprising:

[0007] Retrieve the network flow packet data corresponding to the network flow;

[0008] According to the message forwarding strategy, network flow message data is forwarded to the secondary cluster; the network flow message data is used to instruct the secondary cluster to perform domain name resolution processing on the network flow message data to obtain domain name information.

[0009] In one embodiment, obtaining the network flow packet data corresponding to the network flow includes:

[0010] Extract the first preset number of packets corresponding to the network flow to obtain the network flow packet data.

[0011] In one embodiment, the preset quantity is determined based on the position of the ClientHello message in the network stream.

[0012] In one embodiment, before the step of obtaining the network flow packet data corresponding to the network flow, the method further includes:

[0013] By using the quintuple information, packet data belonging to the same network flow are aggregated into the same processing unit in the primary cluster.

[0014] In one embodiment, the method further includes:

[0015] Based on the traffic type of the network flow, drop or redirect non-HTTPS traffic.

[0016] In one embodiment, according to the packet forwarding policy, forwarding network flow packet data to the secondary cluster includes:

[0017] Based on network flow packet data, a preset feature value algorithm is used to obtain packet feature value information that matches the network flow packet data;

[0018] Based on the message characteristic value information, the network flow message data is forwarded to the target node of the secondary cluster.

[0019] In one embodiment, the preset feature value algorithm includes a consistent hashing algorithm.

[0020] Secondly, this application provides a domain name analysis method applied to a secondary cluster, the method comprising:

[0021] Obtain network flow packet data;

[0022] Domain name resolution is performed on network flow packet data to obtain domain name information.

[0023] In one embodiment, domain name resolution processing is performed on the network flow packet data to obtain domain name information, including:

[0024] Extract the domain name information from the SNI field of the ClientHello message based on network flow packet data.

[0025] In one embodiment, the method further includes:

[0026] The domain information is precisely matched with the domain blacklist and whitelist, and the preset network security policy is executed based on the matching results.

[0027] In one embodiment, the domain name information is precisely matched against a domain name blacklist or whitelist, and a preset network security policy is executed based on the matching result, including:

[0028] If the domain name information is in the blacklist, a blocking instruction will be sent to the network firewall or traffic management system to cut off the network connection corresponding to the domain name information.

[0029] If the domain name is in the whitelist, then network connections are allowed to access the business system or website corresponding to the domain name normally.

[0030] Thirdly, this application provides a domain name analysis device applied to a primary cluster, the device comprising:

[0031] The message data capture module is used to acquire network flow message data corresponding to the network flow;

[0032] The packet data forwarding module is used to forward network flow packet data to the secondary cluster according to the packet forwarding strategy; the network flow packet data is used to instruct the secondary cluster to perform domain name resolution processing on the network flow packet data to obtain domain name information.

[0033] Fourthly, this application provides a domain name analysis device applied to a secondary cluster, the device comprising:

[0034] The message data receiving module is used to acquire network flow message data;

[0035] The domain name resolution processing module is used to perform domain name resolution processing on network flow packet data to obtain domain name information.

[0036] Fifthly, this application provides a domain name analysis system, which includes a primary cluster and a secondary cluster;

[0037] The primary cluster is used to perform the steps of the method described in any embodiment of the first aspect;

[0038] The secondary cluster is used to perform the steps of the method described in any embodiment of the second aspect.

[0039] In a sixth aspect, this application provides an electronic device including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the method described in any one of the embodiments of the first and second aspects of claims.

[0040] The aforementioned domain name analysis method, apparatus, system, and equipment acquire network flow packet data corresponding to the network flow; according to the packet forwarding strategy, the network flow packet data is forwarded to the secondary cluster to instruct the secondary cluster to perform domain name resolution processing on the network flow packet data to obtain the required domain name information. Through the above method, this application can effectively improve the efficiency of domain name extraction. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1 This is a diagram illustrating the application environment of a domain name analysis method in one embodiment;

[0043] Figure 2 This is a flowchart illustrating a domain name analysis method applied to a primary cluster in one embodiment;

[0044] Figure 3This is a flowchart illustrating the process of forwarding network flow packet data in one embodiment;

[0045] Figure 4 This is a flowchart illustrating a domain name analysis method applied to a secondary cluster in one embodiment;

[0046] Figure 5 This is a flowchart illustrating the matching of network security policies in one embodiment;

[0047] Figure 6 This is a schematic diagram of the message processing flow corresponding to the domain name analysis method in one embodiment;

[0048] Figure 7 This is a schematic diagram of a system architecture consisting of a primary cluster and a secondary cluster in one embodiment;

[0049] Figure 8 This is a schematic diagram of the primary cluster processing flow in one embodiment;

[0050] Figure 9 This is a schematic diagram of the secondary cluster processing flow in one embodiment;

[0051] Figure 10 This is a structural block diagram of a domain name analysis device in one embodiment;

[0052] Figure 11 This is a structural block diagram of a domain name analysis device in another embodiment;

[0053] Figure 12 This is a diagram of the internal structure of an electronic device in one embodiment. Detailed Implementation

[0054] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0055] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0056] Before introducing the specific embodiments of this application, the technical terms involved in this application will be explained:

[0057] Message: A message is a data unit transmitted in network communication, containing certain control information and user data. The format and content of messages differ across different network protocol layers. For example, in the TCP / IP protocol suite, a message can refer to an IP (Internet Protocol) datagram, a TCP (Transmission Control Protocol) segment, or a UDP (User Datagram Protocol) user datagram. Messages are fundamental to network communication, carrying various types of information within the network.

[0058] The SNI (Server Name Indication) field is an extension field of the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. It is used during the SSL / TLS handshake to indicate the name of the server the client wishes to connect to. This field allows multiple different websites or services to be hosted on a single server, each with a different domain name and certificate. Through the SNI field, the server can select the appropriate certificate for encrypted communication based on the domain name requested by the client, solving the problem of a single server being able to bind only one certificate in traditional SSL / TLS protocols.

[0059] Domain name: A domain name is a hierarchical character identifier used to identify and locate computers on the Internet, and it is easy to remember and recognize. The Domain Name System (DNS) maps domain names to corresponding IP addresses, making it convenient for users to access resources on the Internet through domain names. A domain name consists of multiple parts, such as top-level domains (TLDs), second-level domains, third-level domains, etc., and the parts are separated by periods.

[0060] With the rapid development of the internet, network traffic has experienced explosive growth, especially in scenarios such as data centers, large Internet Service Providers (ISPs), and enterprise networks, where the scale and complexity of network traffic are constantly increasing. Within network traffic, domain names, as key information for identifying and locating internet resources, play a crucial role in network security management tasks such as network monitoring, access control, and content filtering.

[0061] Traditional domain name extraction methods primarily rely on analyzing and processing data packets in network traffic one by one to identify domain name information. However, these methods expose many problems and limitations when facing high-traffic network environments:

[0062] On the one hand, traditional methods for processing network traffic often lack effective preprocessing mechanisms, resulting in the need to process a large number of irrelevant or redundant packets. This not only increases the computational burden on the system but also makes domain name extraction inefficient and difficult to meet real-time requirements. For example, when handling high-concurrency network requests, the system may encounter performance bottlenecks because it needs to analyze each packet one by one, failing to complete the domain name extraction task in a timely manner, thus affecting the execution of network security policies.

[0063] On the other hand, for Hypertext Transfer Protocol Secure (HTTPS) traffic based on Secure Sockets Layer (SSL), its domain name information is typically encapsulated in the Server Name Indication (SNI) field during the SSL handshake process. Traditional domain name extraction methods often require in-depth analysis of the entire SSL handshake process when parsing HTTPS traffic, which involves complex encryption and decryption operations and consumes significant computing resources. In high-traffic scenarios, this method can lead to a sharp decline in system performance, or even service paralysis.

[0064] Furthermore, most existing network traffic processing architectures employ a single processing node or a simple cluster architecture, making it difficult to cope with the dynamic changes and fluctuations in large-scale network traffic. When network traffic suddenly increases, the system often cannot quickly scale up its processing capacity, leading to packet loss or increased processing latency. At the same time, this architecture lacks an effective load balancing mechanism, making it prone to single-point overload, further reducing the system's stability and reliability.

[0065] In summary, traditional domain name extraction methods suffer from low processing efficiency, high resource consumption, difficulty adapting to HTTPS traffic, and poor architectural scalability in high-traffic network environments, making them unsuitable for modern network security management needs. Therefore, there is an urgent need for a more efficient domain name extraction method capable of handling high-traffic network environments to improve extraction efficiency and performance, reduce computational resource consumption, and ensure the effective implementation of network security strategies.

[0066] To address the aforementioned issues, this application provides a domain name analysis method.

[0067] The domain name analysis method provided in this application can be applied to, for example... Figure 1 In the domain name analysis system 100 shown, the primary cluster 102 can be a preprocessing cluster deployed at the network traffic entry point, used to receive traffic from different links through a high-speed network interface. The secondary cluster 104 can be the core processing cluster responsible for domain name extraction, used to receive packets distributed by the primary cluster and perform in-depth analysis of the packets using a dedicated resolution module.

[0068] In one exemplary embodiment, such as Figure 2 As shown, a domain name analysis method is provided, which can be applied to... Figure 1 Taking the first-level cluster 102 as an example, the explanation includes the following steps S202 to S204. Wherein:

[0069] Step S202: Obtain the network flow packet data corresponding to the network flow.

[0070] In a computer network, a network flow refers to a collection of related messages transmitted from a specific source to a specific destination. These messages share common characteristics (such as source IP address, destination IP address, source port, destination port, and transport protocol) and together constitute a network flow. It can be understood that, within network traffic, a network flow is the basic unit for traffic analysis and management.

[0071] For example, a primary cluster node can count the number of packets in each network flow in real time and accurately extract a preset number of packets before the network flow (specifically a TCP flow) to obtain the network flow packet data corresponding to the network flow.

[0072] In some examples, network flow packet data may include a ClientHello message sent by the client, which contains an SNI field.

[0073] Specifically, nodes in a primary cluster can receive network traffic from different links and obtain the network flow packet data corresponding to the network flow from the network traffic.

[0074] Step S204: According to the packet forwarding policy, forward the network flow packet data to the secondary cluster.

[0075] Among them, network flow packet data can be used to instruct the secondary cluster to perform domain name resolution processing on the network flow packet data to obtain domain name information.

[0076] For example, a packet forwarding strategy may include enabling the primary cluster to determine the target node in the secondary cluster based on the feature information corresponding to the network flow packet data, and distributing the network flow packet data belonging to the same network flow to the fixed node of the secondary cluster, thereby ensuring that packets of the same primary cluster are processed by the same node of the secondary cluster, thus avoiding cross-node state synchronization problems.

[0077] Specifically, after the primary cluster obtains the network flow packet data corresponding to the network flow, it can forward the network flow packet data to the target node of the secondary cluster according to the packet forwarding policy, thereby instructing the secondary cluster to perform domain name resolution processing on the network flow packet data to obtain the domain name information corresponding to the network flow packet data.

[0078] The aforementioned domain name analysis method obtains network flow packet data corresponding to the network flow; according to the packet forwarding strategy, the network flow packet data is forwarded to the secondary cluster to instruct the secondary cluster to perform domain name resolution processing on the network flow packet data to obtain the required domain name information. Through this method, this embodiment of the application adopts a two-level architecture design (primary cluster and secondary cluster) to separate the packet preprocessing and domain name extraction of network traffic, thereby achieving distributed computing of the task. It can be understood that the primary cluster is responsible for capturing network traffic and forwarding packets selectively, which can effectively reduce unnecessary packet processing and lower system load; the secondary cluster focuses on resolving key packets and processing domain name information, thereby effectively improving the efficiency of domain name extraction in high-traffic network environments, and thus ensuring a rapid response to domain name requests in network traffic.

[0079] In one embodiment, obtaining the network flow packet data corresponding to the network flow includes the following steps:

[0080] Extract the first preset number of packets corresponding to the network flow to obtain the network flow packet data.

[0081] For example, the preset number is determined based on the position of the ClientHello message in the network stream.

[0082] In some examples, network flow packet data may include a ClientHello message sent by the client, which contains an SNI field.

[0083] It's understandable that during the SSL / TLS handshake, the ClientHello message sent by the client typically appears early in the TCP stream. By setting a reasonable preset number, it can be ensured that the secondary cluster can obtain the SNI field.

[0084] Specifically, this application embodiment extracts a preset number of packets corresponding to the network flow to ensure that the network flow packet data can contain ClientHello packets, thereby ensuring that the secondary cluster can obtain the SNI field and thus ensuring efficient resolution of the domain name.

[0085] In one embodiment, the preset quantity is determined based on the position of the ClientHello message in the network stream.

[0086] It's understandable that during the SSL / TLS handshake, the ClientHello message (containing the SNI field) sent by the client typically appears in the 3rd or 4th message of the TCP stream. Therefore, by setting a reasonable preset number, it's possible to ensure that the network stream message data covers the required fields while avoiding the parsing overhead of subsequent redundant messages, thus significantly saving computational resources.

[0087] In practical applications, the preset number can be set to 5. That is, the first-level cluster can extract the first 5 packets corresponding to the network flow to obtain the network flow packet data, so as to ensure that the second-level cluster can obtain the SNI field while effectively saving the consumption of computing resources.

[0088] In one embodiment, before the step of obtaining the network flow packet data corresponding to the network flow, the method further includes the following steps:

[0089] By using the quintuple information, packet data belonging to the same network flow are aggregated into the same processing unit in the primary cluster.

[0090] A 5-tuple is a method for uniquely identifying network flows, containing five elements: source IP address, destination IP address, source port, destination port, and transport protocol type. It can be understood that the 5-tuple allows for accurate differentiation of different network flows, thereby enabling fine-grained management and control of network traffic.

[0091] Specifically, nodes in a primary cluster can receive traffic from different links through high-speed network interfaces. Then, based on the five-tuple information of the packets (source IP, destination IP, source port, destination port, and protocol type), packets belonging to the same network flow are aggregated into the same processing unit, thereby ensuring the integrity and continuity of traffic and effectively improving the stability and reliability of domain name extraction and analysis.

[0092] In one embodiment, the method further includes the following steps:

[0093] Based on the traffic type of the network flow, drop or redirect non-HTTPS traffic.

[0094] Specifically, the primary cluster can also perform preliminary classification of received network traffic, directly discarding or transferring non-HTTPS traffic (such as HTTP, UDP, etc.) to other processing modules in the primary cluster, thereby reducing redundant processing in the primary cluster and effectively improving the efficiency of domain name extraction and analysis as well as system performance.

[0095] In one embodiment, such as Figure 3 As shown, according to the packet forwarding strategy, network flow packet data is forwarded to the secondary cluster, including the following steps S302 to S304. Wherein:

[0096] Step S302: Based on the network flow packet data, use a preset feature value algorithm to obtain the packet feature value information that matches the network flow packet data.

[0097] Among them, the preset feature value algorithm can be used to calculate the corresponding message feature value information based on the feature information (such as quintuples) of network flow message data, so as to map messages belonging to the same first-level cluster to the target nodes in the second-level cluster.

[0098] Specifically, a primary cluster can obtain packet feature value information that matches network flow packet data by using a preset feature value algorithm based on network flow packet data.

[0099] Step S304: Based on the message characteristic value information, forward the network flow message data to the target node of the secondary cluster.

[0100] Specifically, after obtaining the packet feature value information corresponding to the network flow packet data, the primary cluster can distribute the network flow packet data to the target node of the secondary cluster based on the packet feature value information.

[0101] In one embodiment, the preset feature value algorithm includes a consistent hashing algorithm.

[0102] Among them, the consistent hashing algorithm can calculate the corresponding hash value based on the five-tuple of the network flow (source IP, destination IP, source port, destination port, protocol type) and map the message to the target node in the secondary cluster.

[0103] It is understandable that the symmetry of the consistent hashing algorithm can ensure that uplink and downlink packets of the same network flow are distributed to the same node, thereby achieving symmetric distribution and state consistency.

[0104] Furthermore, when the number of secondary cluster nodes changes, the consistent hashing algorithm can minimize the number of messages that need to be redistributed, thereby ensuring the system's load balancing and stable operation.

[0105] Specifically, the primary cluster can use a consistent hashing algorithm to obtain packet feature information matching the network flow packet data, and then forward the network flow packet data to the target node of the secondary cluster according to the packet feature information. This embodiment of the application achieves uniform distribution and load balancing of packets in the secondary cluster through the above method, and also implements an efficient and scalable domain name extraction task distribution mechanism in the system.

[0106] In one exemplary embodiment, such as Figure 4 As shown, a domain name analysis method is provided, which can be applied to... Figure 1 Taking the secondary cluster 104 as an example, the explanation includes the following steps S402 to S404. Wherein:

[0107] Step S402: Obtain network flow packet data.

[0108] Among them, network flow packet data can be obtained by the primary cluster forwarding to the secondary cluster according to the packet forwarding policy.

[0109] Specifically, the secondary cluster can obtain network flow packet data forwarded from the primary cluster.

[0110] Step S404: Perform domain name resolution processing on the network flow packet data to obtain domain name information.

[0111] In some instances, the secondary cluster can also match and compare the resolved domain name with the locally stored domain name blacklist and whitelist to trigger the corresponding security policy.

[0112] Specifically, the secondary cluster can perform domain name resolution on network flow packet data to obtain domain name information.

[0113] It is understood that the solution provided by the domain name analysis method implemented from the perspective of the second cluster is similar to the solution described in the domain name analysis method implemented from the perspective of the first cluster. Therefore, the specific limitations of one or more embodiments of the domain name analysis method implemented from the perspective of the second cluster provided below can be found in the limitations of the domain name analysis method implemented from the perspective of the first cluster above, and will not be repeated here.

[0114] In one embodiment, performing domain name resolution on network flow packet data to obtain domain name information includes the following steps:

[0115] Extract the domain name information from the SNI field of the ClientHello message based on network flow packet data.

[0116] Specifically, after receiving the distributed message, the secondary cluster node can use a dedicated parsing module to perform in-depth analysis of the message, quickly identify the client's ClientHello message in the SSL handshake process, and accurately extract the domain name information contained in the SNI field.

[0117] In one embodiment, the method further includes the following steps:

[0118] The domain information is precisely matched with the domain blacklist and whitelist, and the preset network security policy is executed based on the matching results.

[0119] It is understandable that domain name information may include known malicious websites or phishing domains. For such malicious domain name information, the system needs to accurately identify them and promptly trigger corresponding network security policies.

[0120] Specifically, the secondary cluster can accurately match domain name information with domain name blacklists and whitelists, and execute preset network security policies based on the matching results.

[0121] In one embodiment, such as Figure 5 As shown, the domain name information is precisely matched with the domain name blacklist and whitelist, and a preset network security policy is executed based on the matching result, including the following steps S502 to S504. Wherein:

[0122] In step S502, if the domain name information is in the blacklist, a blocking instruction will be sent to the network firewall or traffic management system to cut off the network connection corresponding to the domain name information.

[0123] Specifically, if the secondary cluster identifies a domain name in the blacklist (such as a known malicious website or phishing domain), it will send a blocking command to the network firewall or traffic management system to immediately cut off the network connection and prevent malicious behavior from occurring.

[0124] Step S504: If the domain name information is in the whitelist, then network connection is allowed to access the business system or website corresponding to the domain name information normally.

[0125] Specifically, if the secondary cluster identifies a domain name as being in the whitelist (such as a trusted business system or a frequently used website), it will allow normal access to ensure business continuity and user experience.

[0126] Furthermore, the secondary cluster can dynamically update the domain name blacklist and whitelist, ensuring the real-time nature and accuracy of the list by connecting with external threat intelligence systems. In some examples, for new domain names that cannot match the blacklist or whitelist, further analysis or reporting can be performed according to a preset domain name information update strategy, providing flexible scalability.

[0127] To further illustrate the scheme of this application, a specific example is provided below. Figure 6 Taking the packet processing flow of the domain name analysis system shown as an example, it can effectively solve the problem of low domain name extraction efficiency in traditional methods under high traffic conditions. The packet processing flow is as follows:

[0128] ① Packet capture and routing: The system architecture consisting of a primary cluster and a secondary cluster is as follows Figure 7 As shown in the diagram, nodes in the primary cluster receive traffic from different links of the splitter via a high-speed network interface. Then, based on the packet's five-tuple information (source IP, destination IP, source port, destination port, and protocol type), packets belonging to the same network flow are aggregated together to ensure the integrity and continuity of the network flow. Simultaneously, the network traffic is initially classified, with non-HTTPS traffic (such as HTTP and UDP) either discarded directly or transferred to other processing modules to reduce redundant processing.

[0129] ② Packet Counting and Filtering: The primary cluster nodes count the number of packets for each network flow in real time, accurately extracting the first 5 packets of the TCP flow (since the ClientHello packet (containing the SNI field) sent by the client during the SSL / TLS handshake usually appears in the 3rd-4th packet of the TCP flow, using the first 5 packets ensures that the required fields are covered, avoiding the parsing overhead of subsequent redundant packets). The key feature values ​​of the packets are calculated using a consistent hashing algorithm to determine their target nodes in the secondary cluster and distribute them. It can be understood that the processing flow for the primary cluster in the above packet processing flow can be described as follows: Figure 8 As shown.

[0130] ③ Domain Name Extraction and Processing: After receiving the distributed packets, the secondary cluster nodes use a dedicated parsing module to perform in-depth analysis of the packets, quickly identifying the client hello message (i.e., ClientHello message) during the SSL handshake process, and accurately extracting the domain name information contained in the SNI field. Then, the parsed domain name is matched against the locally stored domain name blacklist and whitelist to trigger the corresponding security policy. It can be understood that the processing flow for the secondary cluster in the above packet processing flow is as shown in Figure 9, where "RST blocking" indicates that the network security device actively sends a TCP RST message to directly and forcibly close the TCP connection between the current client and the blacklisted domain name, thereby preventing further communication.

[0131] It should be noted that in the above processing flow, the primary cluster is deployed at the network traffic ingress point to capture incoming network traffic and distribute it according to the five-tuple information of the packets, ensuring that packets from the same network flow are aggregated together. Simultaneously, the primary cluster counts the number of packets in each network flow in real time, accurately extracting the top 5 packets from each flow, and then evenly distributing these packets to the secondary cluster using a consistent hashing algorithm. This preprocessing mechanism of the primary cluster effectively reduces the number of packets processed subsequently, lowering the system load. Furthermore, the consistent hashing algorithm ensures the even distribution of packets in the secondary cluster, avoiding single-point overload and improving the overall processing efficiency and performance of the system, ensuring a rapid response to domain name requests in network traffic.

[0132] Furthermore, the two-tier architecture of the domain name analysis system in this application facilitates horizontal scaling. As network traffic increases, the system's processing capacity can be enhanced by adding nodes to the primary and secondary clusters. The consistent hashing algorithm minimizes the number of packets requiring reallocation when nodes are added or removed, ensuring stable system operation. This scalability design allows the solution to adapt to network environments of varying sizes and needs, easily handling network traffic growth. By flexibly increasing the number of nodes, it can meet the high concurrency and high traffic demands of scenarios such as large data centers and internet service providers, improving the overall availability and reliability of the system.

[0133] In some possible implementations, to further illustrate the implementation methods and technical effects of this application, taking the application of the domain name analysis method of this application to a data center network traffic monitoring and management scenario as an example, it can be understood that large data centers face massive amounts of network traffic daily, which includes a large number of requests based on the HTTPS protocol. To ensure network security, data centers need to monitor and manage the domain name information in this traffic in real time. Exemplarily, in a data center scenario, the implementation steps of the solution of this application are as follows: A1 to A4. Wherein:

[0134] A1. Deploy a two-tier cluster: Deploy a primary cluster at the network entry point of the data center, consisting of multiple high-performance server nodes. Each server is equipped with a high-speed network interface card (such as a 100Gbps NIC supporting DPDK technology) to ensure rapid capture of network traffic. Simultaneously, build a secondary cluster in the core processing area of ​​the data center, containing several nodes, each equipped with high computing power and professional protocol parsing capabilities to efficiently process critical packets.

[0135] A2. Packet Capture and Distribution: First-level cluster nodes receive traffic from internal data center servers and external networks in real time via high-speed network interfaces. By parsing the five-tuple information of the packets (source IP, destination IP, source port, destination port, and protocol type), packets from the same network flow are aggregated into the same processing unit, ensuring traffic integrity and continuity. Simultaneously, network traffic is initially classified, with non-HTTPS traffic (such as HTTP and UDP) either discarded directly or transferred to other processing modules to reduce redundant processing.

[0136] A3. Packet Counting and Filtering: The primary cluster nodes count the number of packets for each network flow in real time. Since the client's ClientHello packet (containing the SNI field) is typically located in the first 3-4 packets of the TCP flow during the SSL / TLS handshake, this solution selects the first 5 packets for forwarding to ensure coverage of necessary information and allow for redundancy. A consistent hashing algorithm is used to calculate the hash value of the 5-tuple, and these packets are evenly distributed to the target nodes in the secondary cluster to ensure load balancing. This process avoids deep processing of subsequent packets, reducing system load.

[0137] A4. Domain Name Extraction and Processing: After receiving messages from the primary cluster, the secondary cluster node uses a dedicated protocol parsing module to quickly identify the ClientHello message during the SSL handshake process and extract the domain name information from the SNI field. The parsed domain name is then precisely matched against locally stored domain name blacklists and whitelists. If the domain name is on the blacklist (e.g., a known malicious website or phishing domain), the secondary cluster node sends a blocking command to the network firewall or traffic management system to immediately disconnect the network connection and prevent malicious activity. If the domain name is on the whitelist (e.g., a trusted business system or frequently used website), normal access is allowed to ensure business continuity and user experience.

[0138] In some possible implementations, to further illustrate the implementation methods and technical effects of this application, taking the application of the domain name analysis method of this application to the scenario of Internet Service Provider (ISP) network traffic management as an example, it can be understood that ISPs have the application scenario requirement of managing network traffic from massive user accesses to optimize network resource allocation while preventing users from accessing malicious websites. Exemplarily, in the scenario of ISP network traffic management, the implementation steps of the solution of this application are as follows: B1 to B4. Wherein:

[0139] B1. Deploy a two-tier cluster: Deploy a primary cluster at the ISP's network backbone nodes to capture network traffic from across the entire network. Simultaneously, establish a secondary cluster in the internet service provider's data center to handle domain name extraction and processing of critical packets.

[0140] B2. Packet Capture and Distribution: The primary cluster receives network traffic from different users and regions, and distributes it according to the five-tuple information of the packets to ensure that packets of the same network flow are correctly aggregated.

[0141] B3. Packet Counting and Filtering: The primary cluster counts the number of packets in each network flow in real time, extracts the top 5 packets, and distributes them to the secondary cluster through a consistent hashing algorithm.

[0142] B4. Domain Name Extraction and Processing: The secondary cluster resolves the SNI field in the message to extract domain name information and matches it against the domain name blacklist and whitelist. For domain names matching the blacklist, appropriate blocking measures are taken to prevent users from accessing malicious websites; for domain names in the whitelist, normal access is guaranteed to ensure the user's network experience.

[0143] It is understandable that, considering the application scenarios of this application described above, implementing the solution of this application can achieve at least the following beneficial technical effects:

[0144] ① Improved Domain Name Extraction Efficiency: This application employs a two-tier architecture design, separating network traffic preprocessing and domain name extraction to achieve distributed computing. The first-tier cluster captures network traffic and forwards only the first few packets of the TCP network stream, reducing unnecessary packet processing and lowering system load. The second-tier cluster focuses on parsing the SNI field in key packets and processing domain name information, improving domain name extraction efficiency and ensuring rapid response to domain name requests in network traffic.

[0145] ② Reduced computational resource consumption: In high-traffic network environments, traditional domain name extraction methods often require significant computational resources to process massive amounts of packets. This application reduces the deep processing of the entire network traffic by extracting only the first 5 packets of each network flow for domain name resolution, effectively reducing computational resource consumption, improving resource utilization efficiency, enabling the system to operate more economically, and reserving more computational resources for other network services.

[0146] ③ Enhanced system scalability: The consistent hashing algorithm distributes packets evenly across different nodes in the secondary cluster, ensuring load balancing. This design allows for easy horizontal scaling; by increasing the number of nodes in the primary and secondary clusters, it can easily handle network traffic growth, meet the needs of network environments of different sizes, improve the overall processing capacity of the system, and ensure stable operation under high concurrency and high traffic conditions.

[0147] ④ Improved HTTPS traffic processing capabilities: With the widespread application of the HTTPS protocol in networks, efficient parsing of the SNI field in HTTPS traffic has become crucial for domain name extraction. The secondary cluster in this application employs a dedicated parsing module that can quickly identify the client's hello message during the SSL handshake process and extract the domain name information from the SNI field. This solves the problem of low efficiency in traditional methods when processing HTTPS traffic, achieving accurate and rapid extraction of domain name information from HTTPS traffic, thus adapting to the development trend of modern network communication.

[0148] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0149] Based on the same inventive concept, this application also provides a domain name analysis apparatus for implementing the domain name analysis method described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations in one or more domain name analysis apparatus embodiments provided below can be found in the limitations of the domain name analysis method described above, and will not be repeated here.

[0150] In one exemplary embodiment, such as Figure 10 As shown, a domain name analysis device 800 is provided, applied to a primary cluster. The device 800 includes:

[0151] Message data capture module 802 is used to acquire network flow message data corresponding to network flow;

[0152] The packet data forwarding module 804 is used to forward network flow packet data to the secondary cluster according to the packet forwarding strategy; wherein, the network flow packet data is used to instruct the secondary cluster to perform domain name resolution processing on the network flow packet data to obtain domain name information.

[0153] In one embodiment, the packet data capture module 802 is further configured to extract a preset number of packets corresponding to the network flow to obtain network flow packet data.

[0154] In one embodiment, the preset quantity is determined based on the position of the ClientHello message in the network stream.

[0155] In one embodiment, the device 800 further includes:

[0156] The aggregation module is used to aggregate packet data belonging to the same network flow into the same processing unit in the primary cluster using the five-tuple information.

[0157] In one embodiment, the device 800 further includes:

[0158] The filtering module is used to discard or redirect non-HTTPS traffic based on the type of network flow.

[0159] In one embodiment, the packet data forwarding module 804 is further configured to obtain packet feature value information matching the network flow packet data based on the network flow packet data and using a preset feature value algorithm; and forward the network flow packet data to the target node of the secondary cluster according to the packet feature value information.

[0160] In one embodiment, the preset feature value algorithm includes a consistent hashing algorithm.

[0161] Each module in the aforementioned domain name analysis device 800 can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0162] Based on the same inventive concept, this application also provides a domain name analysis apparatus for implementing the domain name analysis method described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations in one or more domain name analysis apparatus embodiments provided below can be found in the limitations of the domain name analysis method described above, and will not be repeated here.

[0163] In one exemplary embodiment, such as Figure 11 As shown, a domain name analysis device 900 is provided, applied to a secondary cluster. The device 900 includes:

[0164] The message data receiving module 902 is used to acquire network flow message data;

[0165] The domain name resolution processing module 904 is used to perform domain name resolution processing on network flow packet data to obtain domain name information.

[0166] In one embodiment, the domain name resolution processing module 904 is also used to extract domain name information from the SNI field based on the ClientHello message of network flow packet data.

[0167] In one embodiment, the device 900 further includes:

[0168] The security policy matching module is used to accurately match domain information with domain blacklists and whitelists, and execute preset network security policies based on the matching results.

[0169] In one embodiment, the security policy matching module is further configured to send a blocking instruction to the network firewall or traffic management system if the domain name information is in the blacklist, so as to cut off the network connection corresponding to the domain name information; if the domain name information is in the whitelist, the network connection is allowed to access the business system or website corresponding to the domain name information normally.

[0170] Each module in the aforementioned domain name analysis device 900 can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0171] In one exemplary embodiment, an electronic device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 12 As shown, this electronic device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores network flow packet data, domain name information, etc. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a domain name analysis method.

[0172] Those skilled in the art will understand that Figure 12 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the electronic device to which the present application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements.

[0173] In one exemplary embodiment, this application provides a domain name analysis system, which includes a primary cluster and a secondary cluster; the primary cluster is used to execute the steps of the method described in the method embodiment applied to the first cluster; the secondary cluster is used to execute the steps of the method described in the method embodiment applied to the second cluster.

[0174] In one embodiment, an electronic device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0175] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0176] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0177] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0178] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0179] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A domain name analysis method characterized by, Applied to a primary cluster, the method comprises: Obtaining network stream message data corresponding to a network stream; According to the message forwarding strategy, the network stream message data is forwarded to a secondary cluster; wherein the network stream message data is used to instruct the secondary cluster to perform domain name resolution processing on the network stream message data to obtain domain name information.

2. The method of claim 1, wherein, The network stream message data corresponding to the network stream is obtained, comprising: Extracting the first preset number of messages corresponding to the network stream to obtain the network stream message data.

3. The method of claim 2, wherein, The preset number is determined based on the position of the ClientHello message in the network stream.

4. The method of claim 1, wherein, Before the step of obtaining the network stream message data corresponding to the network stream, the method further comprises: Using five-tuple information, message data belonging to the same network stream is aggregated to the same processing unit in the primary cluster.

5. The method of claim 1, wherein, The method further comprises: Based on the traffic type of the network stream, discarding or transferring non-HTTPS traffic.

6. The method according to any one of claims 1 to 5, characterized in that, According to the message forwarding strategy, the network stream message data is forwarded to a secondary cluster, comprising: Based on the network stream message data, a preset feature value algorithm is used to obtain message feature value information matching the network stream message data; According to the message feature value information, the network stream message data is forwarded to the target node of the secondary cluster.

7. The method of claim 6, wherein, The preset feature value algorithm includes a consistent hash algorithm.

8. A domain name analysis method characterized by, Applied to a secondary cluster, the method comprises: Obtaining network stream message data; Performing domain name resolution processing on the network stream message data to obtain domain name information.

9. The method of claim 8, wherein, The domain name information is obtained by performing domain name resolution processing on the network stream message data, comprising: Based on the ClientHello message of the network stream message data, the domain name information in the SNI field is extracted.

10. The method according to claim 8 or 9, characterized in that, The method further comprises: The domain name information is accurately matched with the domain name black and white list, and a preset network security strategy is executed according to the matching result.

11. The method of claim 10, wherein, The domain name information is accurately matched with the domain name black and white list, and a preset network security strategy is executed according to the matching result, comprising: If the domain name information is in the blacklist, a blocking instruction is sent to the network firewall or traffic management system to cut off the network connection corresponding to the domain name information; If the domain name information is in the whitelist, the network connection is allowed to normally access the business system or website corresponding to the domain name information.

12. A domain name analysis apparatus characterized by comprising: Applied to a primary cluster, the device comprises: A message data capture module for obtaining network stream message data corresponding to a network stream; A message data forwarding module for forwarding the network stream message data to a secondary cluster according to a message forwarding strategy; wherein the network stream message data is used to instruct the secondary cluster to perform domain name resolution processing on the network stream message data to obtain domain name information.

13. A domain name analysis apparatus characterized by comprising: Applied to a secondary cluster, the device comprises: A message data receiving module for obtaining network stream message data; A domain name resolution processing module for performing domain name resolution processing on the network stream message data to obtain domain name information.

14. A domain name analysis system characterized by, The system comprises a primary cluster and a secondary cluster; The primary cluster is used to execute the steps of the method of any one of claims 1 to 7; The primary cluster is used to execute the steps of the method of any one of claims 1 to 7; The secondary cluster is configured to perform the steps of the method of any of claims 8 to 11.

15. An electronic device, comprising a memory and a processor, the memory storing a computer program, characterized in that, The processor, when executing the computer program, implements the steps of the method of any of claims 1 to 11.

Images