VPN relay node identification method based on domain name and behavior characteristic multi-dimensional analysis

Abstract

The invention discloses a VPN (Virtual Private Network) relay node identification method based on domain name and behavior characteristic multi-dimensional analysis, which comprises the following steps: collecting flow data of a user, forming a complete network session, and separating out a DNS (Domain Name Server) session; statistical analysis is carried out based on the secondary domain name of the VPN relay node and all subordinate sub-domain name sets of the secondary domain name, and domain name features are extracted; the establishment unit analyzes the window to detect the behavior of the user, and if the behavior that the same user initiates dense DNS query for a plurality of sub-domain names under the same secondary domain name is detected, the behavior characteristics of the user are extracted; for IP addresses in the candidate IP address set, fusing domain name features and user behavior features, inputting a random forest model, and outputting an identification result of the VPN relay node; according to the method, high precision and high efficiency can be realized by integrating multi-dimensional correlation characteristics without depending on flow contents in an encryption environment, and the cluster relationship of the VPN relay nodes can be disclosed.

Description

Technical Field

[0001] This invention relates to the field of computer information and network security, specifically to a VPN relay node identification method based on multi-dimensional analysis of domain names and behavioral characteristics. Background Technology

[0002] Virtual Private Networks (VPNs) were originally designed to provide secure internal network access for remote users. However, their end-to-end encryption, while protecting user privacy, also provides anonymity for various illegal online activities, hiding users' true access behavior and thus evading regulation. With the increasing demand for privacy protection among global internet users, the VPN service market has experienced explosive growth. Industry data shows that there are tens of thousands of active VPN vendors worldwide, along with numerous free tools; among them, China's massive internet user base gives it a significant position in global VPN usage.

[0003] Of particular note is the widespread use of new anonymous access tools spurred by the iteration of network encryption technologies. These technologies achieve communication privacy by constructing virtual encrypted tunnels. Some technology service providers have gone further, launching so-called "censorship-resistant" solutions that employ distributed encrypted relays and dynamic redirection mechanisms to form communication networks capable of proactively evading regulation. These advanced anonymity networks significantly increase the difficulty of tracing and obtaining evidence of cybercrimes. Existing research indicates that they have been extensively used for ransomware distribution, phishing, data theft, and other malicious activities.

[0004] Faced with this serious challenge, existing regulatory and detection technologies are clearly inadequate. Traditional traffic detection methods struggle to effectively parse encrypted traffic content, while single-dimensional feature analysis (such as filtering based solely on IP addresses or simple domain names) is easily bypassed by the dynamic nature of relay nodes. Therefore, there is currently a lack of an intelligent technical solution capable of accurately and efficiently identifying VPN relay nodes. Summary of the Invention

[0005] The purpose of this invention is to provide a VPN relay node identification method based on multi-dimensional analysis of domain names and behavioral characteristics. This method constructs a knowledge model by comprehensively analyzing the static Domain Name System (DNS) characteristics and dynamic network behavior characteristics associated with the target network node (such as IP address), thereby achieving high-precision and efficient identification of VPN proxies and anonymous relay nodes.

[0006] To achieve the above functions, this invention designs a VPN relay node identification method based on multi-dimensional analysis of domain names and behavioral characteristics, executing the following steps S1-S4 to complete the identification of VPN relay nodes: Step S1: Collect the user's NEFLOW traffic data at the user's Internet access boundary gateway to form a complete network session, and separate an independent DNS session from it; Step S2: For known VPN relay nodes, perform statistical analysis on the second-level domains of the VPN relay nodes and the set of all subdomains under the second-level domains, and extract domain characteristics to represent the total number of subdomains, geographical orientation, coverage breadth, service regional attributes, and user base. Step S3: Establish a unit resolution window to detect user behavior. If the same user is detected to initiate intensive DNS queries on multiple subdomains under the same second-level domain within a preset time, then extract the user's behavior characteristics. Step S4: For IP addresses in the candidate IP address set, merge domain name features and user behavior features, input the merged features into the random forest model, train the random forest model, and use the random forest model to perform ensemble learning by building multiple decision trees to identify and determine VPN relay nodes. Finally, output the identification result of VPN relay nodes through a voting mechanism. As a preferred technical solution of the present invention, the specific steps of step S1 are as follows: Step S1.1: Collect user's NEFLOW traffic data from the user border gateway, perform session merging, and form a complete network session as follows: ; in, This represents the i-th network session after the merger. , , , , , , , , , These represent the source IP, destination IP, source port, destination port, start time, end time, number of uplink packets, size of uplink packets, number of downlink packets, and size of downlink packets for the i-th network session, respectively. Step S1.2: Separate the complete network session into an independent DNS session, as follows: ; in, This represents the i-th DNS session that was retrieved; , , , , , , These represent the source IP, destination IP, source port, destination port, intercept time, domain name, and the list of IP addresses resolved by the domain name for the i-th DNS session.

[0007] As a preferred technical solution of the present invention, the specific steps of step S2 are as follows: Step S2.1: Quantify the structural characteristics of the second-level domains and all subdomains under the VPN relay nodes, and construct the basic set and key functions as follows: Basic set: Let belong to the domain name The set of all subdomains of the second-level domain D is ;in, These are the subdomains of the second-level domain D; Subdomain name The set of all users is ;in, For subdomains Each user; Subdomain name The set of all resolved IPs is ;in, For subdomains Each resolved IP address; Key functions: Function: If subdomain If the string contains a country / region abbreviation, return 1; otherwise, return 0. Function: Returns the subdomain The set of domestic IPs among all resolved IPs; Function: Returns the subdomain The set of all country / region abbreviations contained in the string; Step S2.2: Based on the base set and key functions, extract domain name features, including subdomain size, percentage of subdomains with country abbreviations, total number of covered country abbreviations, percentage of domestic IP resolutions, and total number of user visits. The specific calculations are as follows: Subdomain size: ; in, Indicates the size of the subdomain. This indicates the number of elements in the set; Percentage of country abbreviation subdomains: ; in, This indicates the percentage of country code abbreviation subdomains. Total number of country abbreviations covered: ; in, This indicates the total number of country abbreviations covered, and U indicates that all elements in the set are merged, with only one duplicate element retained. Percentage of IP addresses resolved within China: ; in, This indicates the percentage of IP addresses resolved within China. Total user visits: ; in, This represents the total number of user visits, and U indicates that all elements in the set are merged, with duplicate elements retained only once.

[0008] As a preferred technical solution of the present invention, the specific steps of step S3 are as follows: Step S3.1: For the same user If a query initiates a series of DNS queries on multiple subdomains under a certain second-level domain, forming a query sequence, and the time interval between adjacent queries in the query sequence does not exceed 1 second, then the query sequence is aggregated into a single action unit, defined as a unit resolution window, as shown in the following formula: ; in, Represents the cell resolution window, Indicates the query sequence. Indicates user The various DNS query behaviors; Step S3.2: Instruct the user In the cell analysis window The set of IP addresses corresponding to the subdomains queried internally is Then the user and All network sessions generated by communication between any IP address and its ports constitute the associated session set. Each session in the associated session set Including its start time With end time ; Step S3.3: Extract user behavioral characteristics, including the concentration of domain names in the unit resolution window and the number of long sessions, calculated as follows: The domain name concentration of the unit resolution window is as follows: ; in This indicates the concentration of domain names within the unit resolution window; This represents the set of non-repeating domain names within the unit resolution window; This represents the number of domain names within a unit resolution window that contains duplicate domain names; This represents the number of unique domain names removed from the unit's parsing window.

[0009] The number of long session entries is as follows: ; in, Indicates the number of long sessions.

[0010] As a preferred embodiment of the present invention, the specific steps of step S4 are as follows: Step S4.1: For the candidate IP address set any IP address in The fusion features are obtained as follows: ; in, The fusion feature representing an IP address is obtained by fusing the 5-dimensional domain name feature obtained from steps S2 and S3 with the 2-dimensional user behavior feature; Step S4.2: Input the fused features into the random forest model to identify VPN relay nodes. The random forest model generates T training subsets through Bootstrap sampling, and trains a decision tree in parallel for each training subset. During the node splitting process of a single decision tree, the Gini coefficient is used as the splitting criterion. The formula for calculating the Gini coefficient is: ; in, Represents a node The Gini coefficient, Represents a node The Middle The proportion of class samples, The total number of sample categories; For candidate split features and splitting threshold Node splitting is performed by selecting candidate splitting features and splitting thresholds that maximize the reduction in the Gini coefficient. ; in, Indicating candidate splitting features and splitting threshold The corresponding decrease in the Gini coefficient; This represents the subset of samples whose values ​​on the current candidate splitting feature j are less than or equal to the splitting threshold t; This represents the subset of samples whose values ​​on the current candidate splitting feature j are greater than the splitting threshold t; For the input IP address to be identified By voting through all decision trees in the random forest model, the probability estimate of its being identified as a VPN relay node is obtained: ; in, This is an indicator function; y represents the category label, which includes VPN relay nodes and non-VPN relay nodes; y=1 represents a positive label, i.e., VPN relay node; This represents the k-th decision tree classifier in the random forest; Indicates the IP address to be identified The probability estimate of being identified as a VPN relay node; if the probability estimate is less than a preset threshold, it is identified as a non-VPN relay node, otherwise it is identified as a VPN relay node.

[0011] As a preferred technical solution of the present invention: when the probability estimate value When the probability estimate is [value], it is determined to be a VPN relay node; when the probability estimate is [value], it is determined to be a VPN relay node. When a node is identified as a non-VPN relay node, the preset threshold is maximized on the verification set. The score is determined.

[0012] The present invention also designs a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements each step of the VPN relay node identification method based on multidimensional analysis of domain names and behavioral features.

[0013] The present invention also designs a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the VPN relay node identification method based on multidimensional analysis of domain names and behavioral features.

[0014] Beneficial effects: Compared with the prior art, the advantages of the present invention include:

[0015] 1. This method uses cross-validation by integrating multi-dimensional features such as domain name structure, IP resources, and real-time behavior, avoiding the limitations of single features. Even if the adversary hides some information, it can still be effectively identified from other dimensions, significantly improving accuracy and robustness.

[0016] 2. This method does not rely on decrypting VPN traffic content, but focuses on analyzing communication metadata and behavioral patterns. By mining the externally observable characteristics exhibited by nodes before, during, and after connection establishment (such as complex domain name structures and frequent speed test behavior), it achieves "side-channel" identification of VPN relay nodes.

[0017] 3. This method can not only identify individual VPN relay IPs, but also, by analyzing features such as "number of IPs used by second-level domains" and "number of IPs for subdomains," it can reverse-engineer the VPN service provider's infrastructure landscape. For example, it can discover multiple relay node clusters belonging to the same service provider and analyze their resource scale and organizational structure. Attached Figure Description

[0018] Figure 1 This is a flowchart of a VPN relay node identification method based on multi-dimensional analysis of domain names and behavioral characteristics, provided by an embodiment of the present invention. Detailed Implementation

[0019] The present invention will be further described below with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and should not be used to limit the scope of protection of the present invention.

[0020] The VPN relay node identification method based on multi-dimensional analysis of domain names and behavioral characteristics provided in this embodiment of the invention refers to... Figure 1 Perform the following steps S1-S4 to complete the identification of the VPN relay node: Step S1: Collect the user's NEFLOW traffic data at the user's Internet access boundary gateway to form a complete network session, and separate an independent DNS session from it; Step S1 mainly involves the collection and structured processing of the raw network data. The specific steps are as follows: Step S1.1: Collect user's NEFLOW traffic data from the user border gateway, perform session merging, and form a complete network session as follows: ; in, This represents the i-th network session after the merger. , , , , , , , , , These represent the source IP, destination IP, source port, destination port, start time, end time, number of uplink packets, size of uplink packets, number of downlink packets, and size of downlink packets for the i-th network session, respectively. Step S1.2: Separate the complete network session into an independent DNS session, as follows: ; in, This represents the i-th DNS session that was retrieved; , , , , , , These represent the source IP, destination IP, source port, destination port, intercept time, domain name, and the list of IP addresses resolved by the domain name for the i-th DNS session.

[0021] Step S2: For known VPN relay nodes, perform statistical analysis on the second-level domains of the VPN relay nodes and the set of all subdomains under the second-level domains, and extract domain characteristics to represent the total number of subdomains, geographical orientation, coverage breadth, service regional attributes, and user base. Step S2 aims to quantify the structural characteristics of the associated domain names of known VPN relay nodes. The specific steps are as follows: Step S2.1: Quantify the structural characteristics of the second-level domains and all subdomains under the VPN relay nodes, and construct the basic set and key functions as follows: Basic set: Let belong to the domain name The set of all subdomains of the second-level domain D is ;in, These are the subdomains of the second-level domain D; Subdomain name The set of all users is ;in, For subdomains Each user; Subdomain name The set of all resolved IPs is ;in, For subdomains Each resolved IP address; Key functions: Function: If subdomain If the string contains a country / region abbreviation, return 1; otherwise, return 0. Function: Returns the subdomain The set of domestic IPs among all resolved IPs; Function: Returns the subdomain The set of all country / region abbreviations contained in the string; Step S2.2: Based on the base set and key functions, extract domain name features, including subdomain size, percentage of subdomains with country abbreviations, total number of covered country abbreviations, percentage of domestic IP resolutions, and total number of user visits. The specific calculations are as follows: Subdomain size, this feature measures the total number of subdomains under a second-level domain, and is calculated as follows: ; in, Indicates the size of the subdomain. This indicates the number of elements in the set; The percentage of country abbreviation subdomains, which reflects the prevalence of geographical bias in subdomain naming, is calculated as follows: ; in, This indicates the percentage of country code abbreviation subdomains. The total number of country abbreviations covered is assessed by counting the number of unique country abbreviations appearing in all subdomains to evaluate the breadth of its global coverage, calculated as follows: ; in, This indicates the total number of country abbreviations covered, and U indicates that all elements in the set are merged, with only one duplicate element retained. The proportion of IP addresses resolved within China is calculated by analyzing the IP addresses resolved by all subdomains, thus helping to determine the geographical location of the service. The calculation is as follows: ; in, This indicates the percentage of IP addresses resolved within China. Total user visits: This feature counts the total number of unique visitors across all subdomains under the second-level domain, serving as a measure of its user base. It is calculated using the following formula: ; in, This represents the total number of user visits, and U indicates that all elements in the set are merged, with duplicate elements retained only once.

[0022] Step S3: Establish a unit resolution window to detect user behavior. If the same user is detected to initiate intensive DNS queries on multiple subdomains under the same second-level domain within a preset time, then extract the user's behavior characteristics. Step S3 aims to extract discriminative statistical features from the behavioral patterns of user interactions with VPN relay nodes. The specific steps are as follows: Step S3.1: For the same user If a query initiates a series of DNS queries on multiple subdomains under a certain second-level domain, forming a query sequence, and the time interval between adjacent queries in the query sequence does not exceed 1 second, then the query sequence is aggregated into a single action unit, defined as a unit resolution window, as shown in the following formula: ; in, Represents the cell resolution window, Indicates the query sequence. Indicates user The various DNS query behaviors; Step S3.2: Instruct the user In the cell analysis window The set of IP addresses corresponding to the subdomains queried internally is Then the user and All network sessions generated by communication between any IP address and its ports constitute the associated session set. Each session in the associated session set Including its start time With end time ; Step S3.3: Extract user behavioral characteristics, including the concentration of domain names in the unit resolution window and the number of long sessions, calculated as follows: Domain name concentration in a single DNS window reflects the density and focus of query behavior within that window, and is calculated as follows: ; in, This indicates the concentration of domain names within the unit resolution window; This represents the set of non-repeating domain names within the unit resolution window; This represents the number of domain names within a unit resolution window that contains duplicate domain names; This represents the number of unique domain names removed from the unit's parsing window.

[0023] Long session count: This feature counts the number of network sessions (≥5 seconds) established between the user and the IP address resolved by the domain name within the window, as well as the related port. It is used to identify continuous and stable connection behavior and is calculated as follows: ; in, Indicates the number of long sessions.

[0024] Step S4: For IP addresses in the candidate IP address set, merge domain name features and user behavior features, input the merged features into the random forest model, train the random forest model, and use the random forest model to perform ensemble learning by building multiple decision trees to identify and determine VPN relay nodes. Finally, output the identification result of VPN relay nodes through a voting mechanism. The specific steps of step S4 are as follows: Step S4.1: For the candidate IP address set any IP address in The fusion features are obtained as follows: ; in, The fusion feature of an IP address is obtained by fusing the 5-dimensional domain name feature and the 2-dimensional user behavior feature obtained in steps S2 and S3. Here, the domain name feature and the behavior feature are abbreviated as F. Step S4.2: Input the fused features into the random forest model to identify VPN relay nodes. The random forest model generates T training subsets through Bootstrap sampling, and trains a decision tree in parallel for each training subset. During the node splitting process of a single decision tree, the Gini coefficient is used as the splitting criterion. The formula for calculating the Gini coefficient is: ; in, Represents a node The Gini coefficient, Represents a node The Middle The proportion of class samples, The total number of sample categories; For candidate split features and splitting threshold Node splitting is performed by selecting candidate splitting features and splitting thresholds that maximize the reduction in the Gini coefficient. ; in, Indicating candidate splitting features and splitting threshold The corresponding decrease in the Gini coefficient; This represents the subset of samples whose values ​​on the current candidate splitting feature j are less than or equal to the splitting threshold t; This represents the subset of samples whose values ​​on the current candidate splitting feature j are greater than the splitting threshold t.

[0025] For the input IP address to be identified By voting through all decision trees in the random forest model, the probability estimate of its being identified as a VPN relay node is obtained: ; in, This is an indicator function; y represents the category label, which includes VPN relay nodes and non-VPN relay nodes; y=1 represents a positive label, i.e., VPN relay node; This represents the k-th decision tree classifier in the random forest; Indicates the IP address to be identified The probability estimate of being identified as a VPN relay node; if the probability estimate is less than a preset threshold, it is identified as a non-VPN relay node, otherwise it is identified as a VPN relay node.

[0026] In this embodiment, the preset threshold is set to 0.085, and the probability estimate is... When the probability estimate is [value], it is determined to be a VPN relay node; when the probability estimate is [value], it is determined to be a VPN relay node. When a node is identified as a non-VPN relay node, the preset threshold is maximized on the verification set. Score determination ensures sufficiency of evidence and controls the false alarm rate.

[0027] The flowchart of the VPN relay node identification method based on multidimensional analysis of domain names and behavioral features designed in this invention is shown below. Figure 1 First, user internet traffic is collected at the user's internet boundary gateway. Then, DNS traffic is separated from the user's internet traffic and merged into Flow sessions and DNS sessions by a Flow correlator and a DNS correlator, respectively, to prepare for feature extraction. Subsequently, in the feature extraction stage, behavioral features such as "unit resolution window domain name concentration" and "long session coefficient" are extracted from the traffic using the Flow correlator, while five types of domain name features, including "subdomain size" and "proportion of country abbreviation subdomains," are extracted from the DNS data using the DNS correlator. Next, in the model building and training stage, the above multi-dimensional features are fused into a feature vector, and a random forest classifier is trained using this vector to enable the model to learn the discrimination rules between VPN and non-VPN relay nodes. Finally, in the identification and output stage, the trained model can directly classify the input feature vector. Based on one day of full-domain user traffic data and 2357 known VPN relay nodes, this method was validated, achieving a VPN relay node identification accuracy of 93% and a recall rate of 87%.

[0028] This invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements each step of the VPN relay node identification method based on multidimensional analysis of domain names and behavioral features.

[0029] This invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the VPN relay node identification method based on multidimensional analysis of domain names and behavioral features.

[0030] The method designed in this invention solves the following technical problems:

[0031] 1. Limited Feature Detection and Easily Circumvented: Existing methods often rely on IP blacklists, known ports, or single traffic characteristics (such as packet size or traffic timing) for identification. These methods have limited feature dimensions and are difficult to counter proactive circumvention techniques employed by VPN service providers, such as changing IP addresses, using non-standard ports, and introducing traffic obfuscation. This results in low accuracy and poor robustness.

[0032] 2. Difficulty in parsing encrypted traffic: Because VPN traffic generally uses high-strength encryption, traditional deep packet inspection (DPI) techniques cannot parse its communication content, thus losing the most direct basis for analysis. How to effectively identify VPN relay nodes without decryption is a significant challenge.

[0033] 3. Lack of global insight into VPN nodes: Most existing technologies are limited to isolated assessments of individual IP addresses, lacking effective means to connect and reveal the VPN service providers and their overall ecosystem behind these nodes. This "seeing the trees but not the forest" situation makes it difficult to address the root causes of problems and to effectively combat VPN service clusters on a large scale.

[0034] The embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the present invention is not limited to the above embodiments. Within the scope of knowledge possessed by those skilled in the art, various changes can be made without departing from the spirit of the present invention.

Claims

1. A VPN relay node identification method based on multidimensional analysis of domain names and behavioral characteristics, characterized in that, Perform the following steps S1-S4 to complete the identification of the VPN relay node: Step S1: Collect the user's NEFLOW traffic data at the user's Internet access boundary gateway to form a complete network session, and separate an independent DNS session from it; Step S2: For known VPN relay nodes, perform statistical analysis on the second-level domains of the VPN relay nodes and the set of all subdomains under the second-level domains, and extract domain characteristics to represent the total number of subdomains, geographical orientation, coverage breadth, service regional attributes, and user base. Step S3: Establish a unit resolution window to detect user behavior. If the same user is detected to initiate intensive DNS queries on multiple subdomains under the same second-level domain within a preset time, then extract the user's behavior characteristics. Step S4: For IP addresses in the candidate IP address set, merge domain name features and user behavior features, input the merged features into a random forest model, train the random forest model, and use the random forest model to perform ensemble learning by building multiple decision trees to identify VPN relay nodes. Finally, output the VPN relay node identification result through a voting mechanism.

2. The VPN relay node identification method based on multi-dimensional analysis of domain names and behavioral characteristics according to claim 1, characterized in that, The specific steps of step S1 are as follows: Step S1.1: Collect user's NEFLOW traffic data from the user border gateway, perform session merging, and form a complete network session as follows: ； in, This represents the i-th network session after the merger. , , , , , , , , , These represent the source IP, destination IP, source port, destination port, start time, end time, number of uplink packets, size of uplink packets, number of downlink packets, and size of downlink packets for the i-th network session, respectively. Step S1.2: Separate the complete network session into an independent DNS session, as follows: ； in, This represents the i-th DNS session that was retrieved; , , , , , , These represent the source IP, destination IP, source port, destination port, intercept time, domain name, and the list of IP addresses resolved by the domain name for the i-th DNS session.

3. The VPN relay node identification method based on multi-dimensional analysis of domain names and behavioral characteristics according to claim 1, characterized in that, The specific steps of step S2 are as follows: Step S2.1: Quantify the structural characteristics of the second-level domains and all subdomains under the VPN relay nodes, and construct the basic set and key functions as follows: Basic set: Let belong to the domain name The set of all subdomains of the second-level domain D is ;in, These are the subdomains of the second-level domain D; Subdomain name The set of all users is ;in, For subdomains Each user; Subdomain name The set of all resolved IPs is ;in, For subdomains Each resolved IP address; Key functions: Function: If subdomain If the string contains a country / region abbreviation, return 1; otherwise, return 0. Function: Returns the subdomain The set of domestic IPs among all resolved IPs; Function: Returns the subdomain The set of all country / region abbreviations contained in the string; Step S2.2: Based on the base set and key functions, extract domain name features, including subdomain size, percentage of subdomains with country abbreviations, total number of covered country abbreviations, percentage of domestic IP resolutions, and total number of user visits. The specific calculations are as follows: Subdomain size: ； in, Indicates the size of the subdomain. This indicates the number of elements in the set; Percentage of country abbreviation subdomains: ； in, This indicates the percentage of country code abbreviation subdomains. Total number of country abbreviations covered: ； in, This indicates the total number of country abbreviations covered; U indicates merging all elements of the set, keeping only one duplicate element. Percentage of IP addresses resolved within China: ； in, This indicates the percentage of IP addresses resolved within China. Total user visits: ； in, This represents the total number of user visits, and U indicates that all elements in the set are merged, with duplicate elements retained only once.

4. The VPN relay node identification method based on multi-dimensional analysis of domain names and behavioral characteristics according to claim 1, characterized in that, The specific steps of step S3 are as follows: Step S3.1: For the same user If a query initiates a series of DNS queries on multiple subdomains under a certain second-level domain, forming a query sequence, and the time interval between adjacent queries in the query sequence does not exceed 1 second, then the query sequence is aggregated into a single action unit, defined as a unit resolution window, as shown in the following formula: ； in, Represents the cell resolution window, Indicates the query sequence. Indicates user The various DNS query behaviors; Step S3.2: Instruct the user In the cell analysis window The set of IP addresses corresponding to the subdomains queried internally is Then the user and All network sessions generated by communication between any IP address and its ports constitute the associated session set. Each session in the associated session set Including its start time With end time ; Step S3.3: Extract user behavioral characteristics, including the concentration of domain names in the unit resolution window and the number of long sessions, calculated as follows: The domain name concentration of the unit resolution window is as follows: ； in, This indicates the concentration of domain names within the unit resolution window; This represents the set of non-repeating domain names within the unit resolution window; This represents the number of domain names within a unit resolution window that contains duplicate domain names; The number of duplicate domain names within the unit's parsing window; The number of long session entries is as follows: ； in, Indicates the number of long sessions.

5. The VPN relay node identification method based on multi-dimensional analysis of domain names and behavioral characteristics according to claim 1, characterized in that, The specific steps of step S4 are as follows: Step S4.1: For the candidate IP address set any IP address in The fusion features are obtained as follows: ； in, The fusion feature representing an IP address is obtained by fusing the 5-dimensional domain name feature obtained from steps S2 and S3 with the 2-dimensional user behavior feature; Step S4.2: Input the fused features into the random forest model to identify VPN relay nodes. The random forest model generates T training subsets through Bootstrap sampling, and trains a decision tree in parallel for each training subset. During the node splitting process of a single decision tree, the Gini coefficient is used as the splitting criterion. The formula for calculating the Gini coefficient is: ； in, Represents a node The Gini coefficient, Represents a node The Middle The proportion of class samples, The total number of sample categories; For candidate split features and splitting threshold Node splitting is performed by selecting candidate splitting features and splitting thresholds that maximize the reduction in the Gini coefficient. ； in, Indicating candidate splitting features and splitting threshold The corresponding decrease in the Gini coefficient; This represents the subset of samples whose values ​​on the current candidate splitting feature j are less than or equal to the splitting threshold t; This represents the subset of samples whose values ​​on the current candidate splitting feature j are greater than the splitting threshold t; For the input IP address to be identified By voting through all decision trees in the random forest model, the probability estimate of its being identified as a VPN relay node is obtained: ； in, This is an indicator function; y represents the category label, which includes VPN relay nodes and non-VPN relay nodes; y=1 represents a positive label, i.e., VPN relay node; This represents the k-th decision tree classifier in the random forest; Indicates the IP address to be identified The probability estimate of being identified as a VPN relay node; if the probability estimate is less than a preset threshold, it is identified as a non-VPN relay node, otherwise it is identified as a VPN relay node.

6. The VPN relay node identification method based on multi-dimensional analysis of domain names and behavioral features according to claim 1, characterized in that, When the probability estimate When the probability estimate is [value], it is determined to be a VPN relay node; when the probability estimate is [value], it is determined to be a VPN relay node. At that time, it was determined to be a non-VPN relay node; The preset threshold is maximized on the validation set. The score is determined.

7. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements each step of the VPN relay node identification method based on multidimensional analysis of domain names and behavioral characteristics as described in any one of claims 1 to 6.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements each step of the VPN relay node identification method based on multidimensional analysis of domain name and behavioral characteristics as described in any one of claims 1 to 6.

Images