Method for loading ten-million-level domain name rules based on distributed compilation

By combining distributed compilation and hash table allocation with Hyperscan state machine and Trie tree methods, the problem of excessive loading time for Hyperscan when loading rules for tens of millions of domain names is solved, achieving fast loading and accurate matching.

CN121907815BActive Publication Date: 2026-05-29北京九栖科技有限责任公司
2 Cites 0 Cited by

Patent Information

Authority / Receiving Office
CN · China
Patent Type
Patents(China)
Current Assignee / Owner
北京九栖科技有限责任公司
Filing Date
2026-03-18
Publication Date
2026-05-29

AI Technical Summary

Technical Problem

The existing multi-pattern matching engine Hyperscan takes too long to load rules for tens of millions of domains and cannot perform precise domain matching.

Method used

A distributed compilation method is adopted, which groups the domain name rules for parallel compilation. Hyperscan state machine and Trie tree are used for parallel compilation, and hash table is used for rule allocation. Preliminary matching is performed first and then precise matching is performed.

Benefits of technology

It enables rapid loading of rules for tens of millions of domain names, significantly reducing compilation time and meeting the needs of dynamic large-scale domain name feature recognition.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN121907815B_ABST
    Figure CN121907815B_ABST
Patent Text Reader

Abstract

The application discloses a method for loading ten-million-level domain name rules quickly based on distributed compiling, which comprises the following steps: reading a rule file containing accurate domain names and generic domain names and parsing the rule file, distributing rule parsing result data to hash tables according to the number of groups to obtain a plurality of rule groups; creating the same number of compiling threads as the number of groups to form a compiling thread pool; traversing all the rule groups and assigning a compiling thread to each rule group to execute a compiling task, and using a Hyperscan state machine and a Trie tree to perform distributed parallel compiling; receiving an input domain name string and determining the rule group to which the domain name string belongs; and using the Hyperscan state machine of the rule group to perform preliminary matching, and if a hit is found, using the Trie tree of the rule group to perform accurate matching. The method solves the problem that the Hyperscan lightweight interface cannot accurately limit domain names, and realizes the quick loading of ten-million-level domain name rules.
Need to check novelty before this filing date? Find Prior Art

Citation Information

Patent Citations

  • DNS spoofing method under massive data packet scene

    CN108632202A

  • Malicious domain name detection method and device based on deep reinforcement learning

    CN114050912A