Traffic statistics method and device, vehicle and storage medium

Abstract

The application discloses a traffic statistics method and device, a vehicle and a storage medium. The method comprises the following steps: obtaining domain name query requests corresponding to a plurality of application programs; constructing a target mapping relationship based on the domain name query requests, and returning virtual address information to the plurality of application programs according to the target mapping relationship; in response to the plurality of application programs performing access operations based on the virtual address information, performing traffic statistics based on the virtual address information to obtain a target traffic statistics result, wherein the target traffic statistics result is used to represent traffic use detail information corresponding to a plurality of to-be-accessed domain names. The application solves the technical problems of poor traffic statistics accuracy and low system management efficiency caused by IP address conflicts in the related art.

Description

Technical Field

[0001] This application relates to the field of computer network technology, and more specifically, to a traffic statistics method, apparatus, vehicle, and storage medium. Background Technology

[0002] In modern internet architecture, the Domain Name System (DNS) serves as a fundamental service, responsible for translating easy-to-remember domain names into corresponding Internet Protocol (IP) addresses to facilitate access to network resources. To refine traffic statistics, domain-based traffic monitoring technology has been introduced. This technology constructs a mapping table between IP addresses and domain names, enabling reverse calculation of domain access volume after traffic statistics are performed. However, in typical network environments, the phenomenon of multiple domain names sharing the same real IP address is common. When faced with such IP conflicts, domain-based traffic statistics technology suffers from errors because its mapping mechanism can only associate a single domain name with a real IP address. Consequently, traffic consumption from different domain names is incorrectly merged into statistics, severely impacting the accuracy and usability of traffic data. This, in turn, poses a challenge to the refined management of network resources and the evaluation of business performance.

[0003] There is currently no effective solution to the above problems. Summary of the Invention

[0004] This application provides a traffic statistics method, apparatus, vehicle, and storage medium to at least solve the technical problems of poor traffic statistics accuracy and low system management efficiency caused by IP address conflicts in related technologies.

[0005] According to one aspect of the embodiments of this application, a traffic statistics method is provided, comprising: obtaining domain name query requests corresponding to multiple applications, wherein the domain name query requests include multiple domain names to be accessed corresponding to the multiple applications; constructing a target mapping relationship based on the domain name query requests, wherein the target mapping relationship is used to represent the mapping relationship between the domain names to be accessed, real Internet Protocol addresses, and virtual Internet Protocol addresses; returning virtual address information to the multiple applications according to the target mapping relationship, wherein the virtual address information is used to guide the multiple applications to access data; and in response to the multiple applications performing access operations based on the virtual address information, performing traffic statistics based on the virtual address information to obtain a target traffic statistics result, wherein the target traffic statistics result is used to represent traffic usage details information corresponding to the multiple domain names to be accessed.

[0006] Optionally, constructing a target mapping relationship based on a domain name query request includes: parsing the domain name query request to obtain a domain name resolution result, wherein the domain name resolution result is used to determine the real address information corresponding to multiple domain names to be accessed; in response to the domain name resolution result meeting a preset address condition, constructing a target mapping relationship based on multiple domain names to be accessed, real address information, and virtual address information, wherein the preset address condition is used to determine that the real Internet Protocol addresses corresponding to multiple domain names to be accessed are the same.

[0007] Optionally, in response to the domain name resolution result meeting the preset address conditions, constructing a target mapping relationship based on multiple domain names to be accessed, real address information, and virtual address information includes: in response to the domain name resolution result meeting the preset address conditions, creating a network address translation table, wherein the network address translation table is used to construct a mapping relationship between the same real Internet Protocol address and different virtual Internet Protocol addresses, and there is a one-to-one correspondence between virtual Internet Protocol addresses and domain names to be accessed; using the network address translation table to associate and map real address information and virtual address information to obtain the target mapping relationship.

[0008] Optionally, the traffic statistics method further includes: in response to the domain name resolution result meeting the preset address conditions, filtering the same real Internet Protocol address corresponding to multiple domain names to be accessed to obtain address filtering results; and returning the address filtering results to multiple applications.

[0009] Optionally, traffic statistics based on virtual address information to obtain target traffic statistics results include: obtaining initial traffic statistics results based on virtual address information, wherein the initial traffic statistics results are used to represent the upload traffic record results and download traffic record results corresponding to different virtual Internet Protocol addresses; and determining the target traffic statistics results using the target mapping relationship and the initial traffic statistics results.

[0010] Optionally, the traffic statistics method further includes: in response to multiple applications performing access operations based on virtual address information, obtaining network data streams of multiple applications; using a preset firewall tool to perform address translation on the network data streams to obtain address translation results, wherein the address translation results are used to represent the result of converting the destination address of the network data stream from a virtual Internet Protocol address to a real Internet Protocol address; and performing data transmission based on the address translation results.

[0011] According to another aspect of the embodiments of this application, a traffic statistics device is also provided, comprising: an acquisition module, configured to acquire domain name query requests corresponding to multiple applications, wherein the domain name query requests include multiple domain names to be accessed corresponding to the multiple applications; a construction module, configured to construct a target mapping relationship based on the domain name query requests, wherein the target mapping relationship is used to represent the mapping relationship between the domain names to be accessed, real Internet Protocol addresses, and virtual Internet Protocol addresses; a return module, configured to return virtual address information to the multiple applications according to the target mapping relationship, wherein the virtual address information is used to guide the multiple applications to access data; and a statistics module, configured to perform traffic statistics based on the virtual address information in response to the multiple applications performing access operations based on the virtual address information, and obtain a target traffic statistics result, wherein the target traffic statistics result is used to represent traffic usage details information corresponding to the multiple domain names to be accessed.

[0012] Optionally, the construction module is also used to: parse the domain name query request to obtain the domain name resolution result, wherein the domain name resolution result is used to determine the real address information corresponding to multiple domain names to be accessed; in response to the domain name resolution result meeting the preset address conditions, construct a target mapping relationship based on multiple domain names to be accessed, real address information and virtual address information, wherein the preset address conditions are used to determine that the real Internet Protocol addresses corresponding to multiple domain names to be accessed are the same.

[0013] Optionally, the construction module is also used to: create a network address translation table in response to the domain name resolution result meeting the preset address conditions, wherein the network address translation table is used to construct the mapping relationship between the same real Internet Protocol address and different virtual Internet Protocol addresses, and there is a one-to-one correspondence between the virtual Internet Protocol address and the domain name to be accessed; and use the network address translation table to associate and map real address information and virtual address information to obtain the target mapping relationship.

[0014] Optionally, the traffic statistics device further includes: a filtering module, used to filter the same real Internet Protocol address corresponding to multiple domain names to be accessed in response to the domain name resolution result meeting the preset address conditions, and obtain the address filtering result; the return module is also used to return the address filtering result to multiple applications.

[0015] Optionally, the statistics module is also used to: obtain initial traffic statistics results based on virtual address information, wherein the initial traffic statistics results are used to represent the upload traffic record results and download traffic record results corresponding to different virtual Internet Protocol addresses; and determine the target traffic statistics results using the target mapping relationship and the initial traffic statistics results.

[0016] Optionally, the acquisition module is also used to acquire the network data streams of multiple applications in response to multiple applications performing access operations based on virtual address information; the traffic statistics device further includes: a conversion module, used to perform address conversion on the network data stream using a preset firewall tool to obtain the address conversion result, wherein the address conversion result is used to represent the result of converting the destination address of the network data stream from a virtual Internet Protocol address to a real Internet Protocol address; and a transmission module, used to perform data transmission based on the address conversion result.

[0017] According to another aspect of the embodiments of this application, a vehicle is also provided, including: a memory storing an executable program; and a processor for running the program, wherein the program executes the methods in various embodiments of this application when it runs.

[0018] According to another aspect of the embodiments of this application, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored executable program, wherein, when the executable program is running, it controls the device where the computer-readable storage medium is located to perform the methods of various embodiments of this application.

[0019] According to another aspect of the embodiments of this application, a computer program product is also provided, including a computer program that, when executed by a processor, implements the methods of various embodiments of this application.

[0020] According to another aspect of the embodiments of this application, a computer program product is also provided, including a non-volatile computer-readable storage medium storing a computer program that, when executed by a processor, implements the methods in various embodiments of this application.

[0021] According to another aspect of the embodiments of this application, a computer program is also provided, which, when executed by a processor, implements the methods of the various embodiments of this application.

[0022] In this embodiment, by obtaining domain name query requests corresponding to multiple applications, a target mapping relationship is constructed based on the domain name query requests. Subsequently, virtual address information is returned to multiple applications according to the target mapping relationship. Finally, in response to the multiple applications performing access operations based on the virtual address information, traffic statistics are performed based on the virtual address information to obtain the target traffic statistics results. Even in complex scenarios where multiple domain names share the same real IP address, the construction of the target mapping relationship ensures that the traffic consumption of each domain name can be independently counted and tracked, thereby improving the accuracy and readability of traffic statistics and avoiding statistical errors caused by IP conflicts. In other words, this embodiment, by introducing virtual IP addresses and constructing a precise domain name mapping mechanism, achieves refined statistics and management of application network access traffic. It achieves the goal of providing accurate domain-level traffic usage details while solving the IP conflict problem, thereby improving the technical effect of improving the accuracy of traffic statistics and the efficiency of system management. This solves the technical problems of poor traffic statistics accuracy and low system management efficiency caused by IP address conflicts in related technologies. Attached Figure Description

[0023] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0024] Figure 1 This is a flowchart of a traffic statistics method based on relevant technologies;

[0025] Figure 2 This is a flowchart of a traffic statistics method according to an embodiment of this application;

[0026] Figure 3 This is a schematic diagram of a traffic statistics method according to an embodiment of this application;

[0027] Figure 4 This is a structural block diagram of a flow statistics device according to an embodiment of this application. Detailed Implementation

[0028] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0029] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0030] According to an embodiment of this application, a method embodiment for traffic statistics is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0031] Conventional traffic statistics methods often rely on monitoring at the system kernel level. When an application initiates a network request, it first obtains the IP address corresponding to the target domain name through DNS resolution. Subsequently, the application sends data packets based on the resolved real IP address. During this process, the kernel protocol stack is responsible for packet encapsulation, addressing, and the final transmission. To collect traffic statistics, listening points can be set up at the kernel level to record the sending and receiving of data packets, including traffic volume, timestamps, and source and destination IP addresses. However, since the system kernel does not directly participate in the application-level DNS resolution process, it can only obtain information at the IP address level and cannot know the specific details of domain name access. Therefore, the traffic statistics results of related technologies can only reflect the IP or User Identifier (UID) level and cannot distinguish in detail the traffic consumption of different domain names carried by the same IP address.

[0032] Figure 1 This is a flowchart of a traffic statistics method based on relevant technologies, such as... Figure 1As shown, when application A initiates a network request, it requests a remote DNS server to query the IP address of domain A. When application B initiates a network request, it requests a remote DNS server to query the IP address of domain B. After the query, it is found that the IP address of both domain A and domain B is 1.1.1.1. Applications A and B then access 1.1.1.1. The kernel protocol stack performs traffic statistics and finally obtains the IP traffic usage details for IP address 1.1.1.1, namely 5MB of upload traffic and 3MB of download traffic. However, the usage details for each domain are not available.

[0033] Therefore, when IP conflicts exist—that is, multiple domain names resolve to the same real IP address—traffic statistics in related technologies cannot effectively distinguish and count the multiple domain names separately. All traffic accessing that IP address is aggregated and counted, making it impossible to accurately measure the actual network resources consumed by each business or application. This, in turn, affects the rational allocation of network resources, cost control, and the effective formulation of network security strategies. For enterprises or organizations that require refined management of network resources, the lack of domain-level traffic statistics will severely restrict their network operation efficiency and decision-making quality.

[0034] Figure 2 This is a flowchart of a traffic statistics method according to an embodiment of this application, such as... Figure 2 As shown, the method includes the following steps:

[0035] Step S21: Obtain domain name query requests corresponding to multiple applications, wherein the domain name query requests include multiple domain names to be accessed corresponding to multiple applications;

[0036] Step S22: Construct a target mapping relationship based on the domain name query request, wherein the target mapping relationship is used to represent the mapping relationship between the domain name to be accessed, the real Internet Protocol address, and the virtual Internet Protocol address;

[0037] Step S23: Return virtual address information to multiple applications according to the target mapping relationship, wherein the virtual address information is used to guide multiple applications to access data;

[0038] Step S24: In response to multiple applications performing access operations based on virtual address information, traffic statistics are performed based on the virtual address information to obtain target traffic statistics results, wherein the target traffic statistics results are used to represent the traffic usage details of multiple domain names to be accessed.

[0039] When the application starts up or runs and needs to obtain access information from a remote server, it sends a domain name query request to the DNS server. The domain name query request contains the domain name to be accessed, which is the identifier of the network resource the application wants to establish a connection with. The domain name to be accessed is a string used to identify the remote server or network resource, such as www.a.com.

[0040] When an application needs to access network resources, it sends a domain name query request containing the domain name to be accessed to the system. This embodiment of the application can listen for and capture these domain name query requests, providing a basis for subsequent processing.

[0041] Based on the captured domain name query requests, a target mapping relationship is constructed. The target mapping relationship not only associates the domain name to be accessed with the corresponding real IP address, but also introduces a virtual IP address as an intermediary. This allows the system to distinguish the source of network traffic through the virtual IP address even if multiple domain names resolve to the same real IP address, thereby fundamentally solving the impact of IP conflict on traffic statistics.

[0042] The aforementioned real IP address is a numerical code used to uniquely identify a host or network interface on the Internet. When a DNS server responds to a domain name query request, it returns the real IP address associated with the domain name to be accessed, which is the direct target used by the application to initiate network packets. A virtual IP address, on the other hand, is a virtual IP address generated to differentiate and track the traffic consumption of different domain names at the system level. A target mapping relationship is established between a virtual IP address and a specific domain name to be accessed and a real IP address, enabling the system to accurately identify and statistically analyze the traffic usage of each domain name through the virtual IP address.

[0043] Furthermore, based on the target mapping relationship, virtual address information is returned to the application. This virtual address information is response information containing a virtual IP address, generated by this embodiment based on the target mapping relationship. Upon receiving the virtual address information, the application will use the virtual IP address as the target IP address and initiate a data access operation.

[0044] After receiving the virtual address information, the application uses the corresponding virtual IP address as the target of the network request. The virtual address information provides a distinguishable identifier for traffic statistics, ensuring the accuracy and readability of the traffic statistics.

[0045] In this embodiment, traffic statistics is a process of measuring and recording network data flows, particularly the data transmission volume when an application accesses a specific domain name. Traffic statistics are based on virtual address information, enabling detailed recording of traffic usage for each domain name and generating target traffic statistics results.

[0046] The target traffic statistics results mentioned above are the final output of traffic statistics, containing precise traffic usage details for multiple domains to be accessed. Through these results, network administrators or application developers can clearly understand the traffic consumption of each domain, providing data support for resource allocation, cost control, and network optimization. Even if multiple domains share the same real IP address, the traffic consumption of each domain can be independently calculated, thus significantly improving the accuracy of traffic statistics.

[0047] Based on steps S21 to S24 above, by obtaining domain name query requests corresponding to multiple applications, a target mapping relationship is constructed based on the domain name query requests. Subsequently, virtual address information is returned to multiple applications according to the target mapping relationship. Finally, in response to multiple applications performing access operations based on the virtual address information, traffic statistics are performed based on the virtual address information to obtain the target traffic statistics results. Even in complex scenarios where multiple domain names share the same real IP address, the construction of the target mapping relationship can ensure that the traffic consumption of each domain name can be independently counted and tracked, thereby improving the accuracy and readability of traffic statistics and avoiding statistical errors caused by IP conflicts. In other words, this application embodiment, by introducing virtual IP addresses and constructing a precise domain name mapping mechanism, achieves refined statistics and management of application network access traffic. It achieves the goal of providing accurate domain-level traffic usage details while solving the IP conflict problem, thereby improving the technical effect of improving the accuracy of traffic statistics and system management efficiency, and thus solving the technical problems of poor traffic statistics accuracy and low system management efficiency caused by IP address conflicts in related technologies.

[0048] The traffic statistics method in the embodiments of this application will be further described below.

[0049] In an optional embodiment, step S22, constructing the target mapping relationship based on the domain name query request, includes:

[0050] Step S221: The domain name query request is parsed to obtain the domain name resolution result, wherein the domain name resolution result is used to determine the real address information corresponding to multiple domain names to be accessed;

[0051] Step S222: In response to the domain name resolution result meeting the preset address conditions, a target mapping relationship is constructed based on multiple domain names to be accessed, real address information, and virtual address information. The preset address conditions are used to determine that the real Internet Protocol addresses corresponding to multiple domain names to be accessed are the same.

[0052] Specifically, when multiple domain name query requests return the same real IP address, this application embodiment does not simply merge the domain name traffic statistics, but further introduces a virtual IP address to construct a target mapping relationship of "domain name to be accessed - virtual IP - real IP". This not only solves the statistical error caused by IP bursts, but also ensures that the system can continuously provide accurate domain name-level traffic statistics services even when the network environment changes, improving the flexibility and robustness of overall traffic monitoring.

[0053] When an application initiates a domain name query request, this embodiment first parses the received request to obtain the domain name resolution result. The domain name resolution result contains the real address information corresponding to the domain name to be accessed, laying the foundation for subsequent processing.

[0054] Next, the system checks whether the domain name resolution results meet the preset address conditions, that is, whether multiple domain names to be accessed resolve to the same real IP address. If the preset address conditions are met, a target mapping relationship is constructed based on multiple domain names to be accessed, the real IP address, and the generated virtual IP address to ensure that even in the face of IP conflicts, the traffic consumption of each domain name can be accurately distinguished and tracked through the virtual IP address.

[0055] Table 1 Target Mapping Relationship

[0056]

[0057] As shown in Table 1, each row represents a target mapping relationship. The first row indicates that the virtual IP address 198.18.0.1 is associated with the real IP address 1.1.1.1 and the domain name www.a.com. When an application accesses www.a.com, the system will direct it to use 198.18.0.1 as the target address, instead of directly using 1.1.1.1. Even though www.a.com and www.b.com share the same real IP address, the system can accurately count the network usage of www.a.com by monitoring the traffic of 198.18.0.1. The second row follows the same mapping logic, showing the mapping relationship between the virtual IP address 198.19.0.1, the real IP address 1.1.1.1, and the domain name www.b.com. Access to www.b.com will be redirected to 198.19.0.1, thus allowing independent tracking of www.b.com's data consumption during traffic statistics, unaffected by other domains. By introducing virtual IP addresses, even if multiple domain names resolve to the same real IP address, this application embodiment can still achieve accurate statistics on the traffic consumption of each domain name, effectively avoiding statistical errors caused by IP address conflicts and improving the accuracy and readability of traffic statistics.

[0058] Based on the above optional embodiments, through deep parsing and intelligent processing of domain name query requests, it is possible to build and maintain target mapping relationships in complex network environments with IP conflicts. This effectively solves the problem of inaccurate statistics when a single IP address carries traffic for multiple domain names, making traffic statistics more refined. The consumption of each domain name can be tracked and recorded independently, providing network administrators with more accurate traffic usage details. This helps to optimize network resource allocation, improve network operation efficiency, and also provides strong data support for business monitoring and cost control.

[0059] In an optional embodiment, in step S222, in response to the domain name resolution result meeting the preset address conditions, constructing a target mapping relationship based on multiple domain names to be accessed, real address information, and virtual address information includes:

[0060] Step S2221: In response to the domain name resolution result meeting the preset address conditions, a network address translation table is created. The network address translation table is used to construct the mapping relationship between the same real Internet Protocol address and different virtual Internet Protocol addresses. There is a one-to-one correspondence between the virtual Internet Protocol address and the domain name to be accessed.

[0061] Step S2222: Use the network address translation table to associate and map the real address information and the virtual address information to obtain the target mapping relationship.

[0062] The aforementioned preset address conditions are used to identify whether multiple domain names to be accessed resolve to the same real Internet Protocol address. The existence of these preset address conditions is a key factor in triggering the subsequent creation of the Network Address Translation Table and the construction of the target mapping relationship.

[0063] The aforementioned Network Address Translation (NAT) table is a data structure used to construct the mapping relationship between the same real IP address and different virtual IP addresses. The design of the NAT table ensures that even if multiple domain names point to the same real IP, the system can distinguish between the multiple domain names through different virtual IP addresses, thereby resolving the impact of IP conflicts on traffic statistics.

[0064] The association mapping process using Network Address Translation (NAT) tables aims to combine real address information with virtual address information to form a target mapping relationship. Association mapping ensures a one-to-one correspondence between virtual IP addresses and the domain names to be accessed, providing the necessary mapping information for accurate traffic statistics.

[0065] In response to the domain name resolution result matching the preset address conditions, a network address translation table is created, which can specifically identify and process multiple domain names resolving to the same real IP address. Through this mechanism, the embodiments of this application can introduce virtual IP addresses without changing the original network architecture, creating a unique identifier for each domain name. This allows the system to bypass IP hijacking restrictions, accurately distinguish and track the traffic consumption of different domain names, and greatly improve the accuracy of traffic statistics and the management efficiency of the system.

[0066] In the process of constructing the target mapping relationship, the association mapping performed by the network address translation table ensures the tight binding between the virtual IP address and the domain name to be accessed. Even if different domain names resolve to the same real IP address, the embodiments of this application can achieve independent statistics on the traffic of each domain name by operating on the virtual IP address.

[0067] This application embodiment enables precise statistics on domain-level traffic by constructing a target mapping relationship between the domain name to be accessed, the real IP address, and the virtual IP address. Specifically, the establishment of the target mapping relationship relies on the interception and modification of the DNS resolution process. After receiving the real IP response from the public DNS server, the customized DNS module replaces the original real IP address with a pre-allocated virtual IP address according to the target mapping relationship and returns the virtual IP address to the requesting application.

[0068] Customized DNS modules can be deployed at the terminal device system layer, where the device manufacturer integrates the interception and replacement logic into the DNS module source code. Alternatively, they can be deployed at the LAN gateway side, where the gateway device is configured to redirect all DNS requests to a dedicated mapping program running on the gateway, which then uniformly performs the mapping and replacement of domain names and virtual IPs.

[0069] In the target mapping relationship, each domain name to be accessed corresponds to a unique virtual IP address, and multiple domain names can be mapped to the same real IP address, thus forming a many-to-one or many-to-many mapping structure of "domain name—virtual IP—real IP". To ensure that network requests initiated by applications using virtual IP addresses can still reach the target server normally, network address translation rules can be configured at the kernel network layer through preset firewall tools. This dynamically translates all data packets with virtual IP addresses as their destination addresses into their corresponding real IP addresses according to the target mapping relationship, thereby achieving transparent forwarding of network traffic without changing the application layer communication behavior. This fundamentally decouples the direct binding relationship between domain names and real IPs, providing a structured data foundation for subsequent traffic collection and domain name attribution analysis based on virtual IPs.

[0070] Based on the above optional embodiments, when multiple applications access the same real IP address of a domain name, the system can dynamically create a network address translation table and use the table to construct a target mapping relationship, ensuring that the traffic consumption of each domain name can be recorded and counted independently. This overcomes the statistical difficulties caused by IP address conflicts, improves the accuracy of traffic statistics, and enhances the overall management capabilities of the system, providing strong support for optimizing network resource allocation, refined traffic monitoring, and business data analysis.

[0071] In an optional embodiment, the traffic statistics method in this application further includes:

[0072] In response to the domain name resolution result matching the preset address conditions, the system filters the same real Internet Protocol addresses corresponding to multiple domain names to be accessed, and obtains the address filtering results; the address filtering results are then returned to multiple applications.

[0073] When the domain name resolution result meets the preset address conditions, it indicates that an IP conflict exists, and measures need to be taken to distinguish the traffic of different domain names. The address filtering result is obtained by filtering the same real IP addresses corresponding to multiple domain names to be accessed. This result only includes real IPs that do not have IP conflicts.

[0074] Specifically, firstly, based on preset address conditions, the system checks the resolution results of multiple domain names to be accessed, identifying and marking domain names that resolve to the same real IP address, indicating an IP conflict. Then, the system performs filtering, selecting domain names from the original domain name resolution results that do not involve IP conflicts—that is, domain names that resolve to different real IP addresses—and generating address filtering results. The address filtering results only include information on domain names that resolve to different real IPs, guiding subsequent traffic monitoring and statistics, ensuring that the statistical process is not affected by IP conflicts.

[0075] Based on the above optional embodiments, by responding to the domain name resolution result meeting the preset address conditions, filtering is performed on the same real Internet Protocol address corresponding to multiple domain names to be accessed, and the address filtering result is returned to multiple applications. This can further reduce the impact of IP conflicts, improve the accuracy and readability of traffic statistics, and provide strong data support for the optimized allocation of network resources, business monitoring, and cost control.

[0076] In an optional embodiment, in step S24, traffic statistics are performed based on the virtual address information to obtain the target traffic statistics results, including:

[0077] Initial traffic statistics are obtained based on virtual address information. These initial traffic statistics represent the upload and download traffic records corresponding to different virtual Internet Protocol addresses. The target traffic statistics are then determined using the target mapping relationship and the initial traffic statistics.

[0078] The initial traffic statistics above are based on virtual address information and include both upload and download traffic records. Upload traffic records show the amount of data transmitted by the application to the internet, while download traffic records show the amount of data received from the internet. These initial traffic statistics, based on virtual IP addresses, provide independent traffic statistics for each domain.

[0079] The above target traffic statistics are the output of the process of converting the traffic statistics of virtual address information into detailed traffic usage at the specific domain level based on the target mapping relationship. The target traffic statistics provide detailed records of upload and download traffic for each domain to be accessed, avoiding inaccurate statistics caused by IP conflicts and improving the readability and usability of the statistical information.

[0080] Specifically, during the process of data transmission using virtual IP addresses by the application, the system monitors and records the upload and download traffic information, forming an initial traffic statistics result in units of virtual IP addresses. The initial traffic statistics result reflects the traffic consumption at the virtual IP address level.

[0081] In this embodiment, the initial traffic statistics are compared with the target mapping relationship. Using the information in the mapping table, the traffic records of the virtual IP address are converted into traffic consumption related to a specific domain name. This conversion process elevates traffic statistics from the virtual IP level to the domain name level. Even if multiple domain names resolve to the same real IP, the accurate traffic usage of each domain name can be obtained through independent statistics of the virtual IP.

[0082] To achieve accurate traffic statistics at the domain level based on virtual IP addresses, customized instrumentation can be performed on the kernel network data path. In related technologies, the traffic statistics instrumentation points are located at the control group network packet inbound traffic statistics and control group network packet outbound traffic statistics. The collected IP addresses are the real IP addresses after Network Address Translation (NAT) and cannot be associated with specific domain names.

[0083] In this embodiment, the instrumentation logic can be adjusted to set a traffic statistics instrumentation point in the processing node before NAT translation in the kernel network stack. This allows the virtual IP address and its corresponding packet length to be obtained, and the virtual IP address and traffic byte count are temporarily stored in the kernel area. Subsequently, the user-space traffic statistics service process can periodically read the collected virtual IP traffic data from the kernel area and interact with the customized DNS module deployed in the system to query the original domain name mapped to the virtual IP address. This accurately assigns the traffic to the corresponding domain name and finally outputs traffic statistics results organized by domain name. This achieves accurate traffic attribution and measurement in high-concurrency, multi-domain-shared-the-real-IP scenarios without modifying application-layer behavior or interfering with normal network communication.

[0084] Based on the above optional embodiments, the traffic data of uploading and downloading is collected based on virtual address information to form an initial traffic statistics result. Then, the traffic records based on virtual IP addresses are converted into traffic usage details directly related to the domain name to be accessed using the target mapping relationship. This ensures that the accuracy of traffic statistics is not affected by IP conflicts and achieves accurate statistics on traffic consumption in scenarios where multiple domain names share the same real IP.

[0085] In an optional embodiment, the traffic statistics method in this application further includes:

[0086] In response to multiple applications performing access operations based on virtual address information, the network data streams of multiple applications are obtained;

[0087] The address translation of the network data stream is performed using a preset firewall tool to obtain the address translation result. The address translation result is used to represent the result of converting the destination address of the network data stream from a virtual Internet Protocol address to a real Internet Protocol address.

[0088] Data transmission is performed based on the address translation results.

[0089] Network data stream: In network communication, a network data stream can be a continuous data sequence generated by an application, containing uploaded and downloaded data. Its flow can be divided into upload streams from the local system to the Internet and download streams from the Internet to the local system.

[0090] The aforementioned default firewall tools are network management software that perform address translation, such as iptables, a firewall tool widely used in Linux systems, which can perform network management functions such as packet filtering and address translation. The address translation result is the result obtained after the address translation operation performed by the default firewall tool, representing the output of the process of converting the destination address of network data streams from virtual IP addresses to real IP addresses. The address translation result ensures that data can be correctly sent to the real server corresponding to the target domain name, and at the same time, provides the necessary information conversion for subsequent traffic statistics processing.

[0091] By returning virtual IP addresses through a DNS hijacking module, this embodiment provides an independent access identifier for each domain name. Even if multiple domain names resolve to the same real IP address, traffic consumption can be effectively distinguished and tracked through different virtual IP addresses. This not only enhances the accuracy of traffic statistics but also improves the manageability and traceability of network data flows, providing a solid foundation for refined network resource allocation and cost control. By introducing virtual IP addresses, this embodiment avoids the confusion and errors that may occur when performing traffic statistics directly based on real IP addresses, improving the efficiency and flexibility of network management.

[0092] In this embodiment, when the application initiates a network access request, it uses a virtual IP address returned by the DNS hijacking module, instead of a traditional real IP address. The system, through a monitoring mechanism, can capture network data streams based on the virtual IP address, providing raw data for subsequent address translation and traffic statistics.

[0093] The system uses pre-configured firewall tools to perform address translation on network data streams based on virtual IP addresses, converting the destination address of the data stream from the virtual IP to the real IP. This translation process can be implemented using pre-configured rules, ensuring that data accessed by applications accurately reaches the target server. Simultaneously, the address translation results provide necessary information for subsequent network behavior monitoring and traffic statistics based on the real IP. After address translation is complete, the system continues to perform data upload and download operations based on the translation results, ensuring that data is transmitted along the correct network path.

[0094] Based on the above optional embodiments, network data streams based on virtual IP addresses are used, and then address translation is performed using preset firewall tools to convert virtual IP addresses into real IP addresses, ensuring that data is accurately transmitted to the target server. This not only optimizes the accuracy of traffic statistics but also enhances the manageability and traceability of network data streams, providing strong technical support for achieving refined network resource management and business operations, and improving the efficiency and security of network communication.

[0095] Figure 3 This is a schematic diagram of a traffic statistics method according to an embodiment of this application, such as... Figure 3 As shown, when application A initiates a network request, it requests a remote DNS server to query the IP address of domain A. When application B initiates a network request, it requests a remote DNS server to query the IP address of domain B. The queries reveal that the IP address of both domain A and domain B is 1.1.1.1. Using a DNS hijacking module, a target mapping relationship is created. In this mapping, the virtual IP address 198.18.0.1 is associated with the real IP address 1.1.1.1 and the domain www.a.com, and the virtual IP address 198.19.0.1 is associated with the real IP address 1.1.1.1 and the domain www.b.com. When an application accesses www.a.com, the system will direct it to use 198.18.0.1 as the target address instead of directly using 1.1.1.1. Similarly, when an application accesses www.b.com, the system will direct it to use 198.19.0.1 as the target address instead of directly using 1.1.1.1. After creating the target mapping relationship, the DNS hijacking module can also configure the system iptables firewall rules to specify that 198.18.0.1 is sent through exit α and 198.19.0.1 is sent through exit β. It can also configure network address translation rules to specify that the destination IP of 198.18.0.1 is translated to 1.1.1.1 and the destination IP of 198.19.0.1 is translated to 1.1.1.1.

[0096] The DNS hijacking module returns the virtual IP address 198.18.0.1 to application A and the virtual IP address 198.19.0.1 to application B. Application A initiates a network access request based on the virtual IP address 198.18.0.1, and application B also initiates a network access request based on the virtual IP address 198.19.0.1. Subsequently, the system uses a pre-defined firewall tool to perform address translation on the network data streams generated by the two applications, ensuring that the destination address of the data stream is translated from the virtual IP address to the real IP address, and records the address translation results. Even if application A and application B both point to the same real IP address, by using different virtual IPs, the system can accurately distinguish and track the traffic consumption of the two applications. Finally, based on the address translation results, the system executes data transmission and records the initial traffic statistics based on the virtual IP addresses using the traffic statistics component: 198.18.0.1 has an upload traffic of 1MB and a download traffic of 2MB, while 198.19.0.1 has an upload traffic of 4MB and a download traffic of 1MB. The target traffic statistics can be determined by the target mapping relationship, namely, the upload traffic of domain name www.a.com is 1MB and the download traffic is 2MB, and the upload traffic of domain name www.b.com is 4MB and the download traffic is 1MB.

[0097] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0098] According to an embodiment of this application, an apparatus embodiment for a traffic statistics method is provided. It should be noted that the apparatus can be used to execute the above-described traffic statistics method.

[0099] Figure 4 This is a structural block diagram of a flow rate counting device according to an embodiment of this application, such as... Figure 4 As shown, the device includes:

[0100] The acquisition module 401 is used to acquire domain name query requests corresponding to multiple applications, wherein the domain name query requests include multiple domain names to be accessed corresponding to multiple applications;

[0101] Module 402 is used to construct a target mapping relationship based on the domain name query request. The target mapping relationship is used to represent the mapping relationship between the domain name to be accessed, the real Internet Protocol address, and the virtual Internet Protocol address.

[0102] Return module 403 is used to return virtual address information to multiple applications according to the target mapping relationship, wherein the virtual address information is used to guide multiple applications to access data;

[0103] The statistics module 404 is used to respond to multiple applications performing access operations based on virtual address information, perform traffic statistics based on virtual address information, and obtain target traffic statistics results. The target traffic statistics results are used to represent the traffic usage details of multiple domain names to be accessed.

[0104] Optionally, the construction module 402 is further configured to: parse the domain name query request to obtain the domain name resolution result, wherein the domain name resolution result is used to determine the real address information corresponding to multiple domain names to be accessed; and in response to the domain name resolution result meeting the preset address conditions, construct a target mapping relationship based on multiple domain names to be accessed, real address information and virtual address information, wherein the preset address conditions are used to determine that the real Internet Protocol addresses corresponding to multiple domain names to be accessed are the same.

[0105] Optionally, the construction module 402 is further configured to: in response to the domain name resolution result meeting the preset address conditions, create a network address translation table, wherein the network address translation table is used to construct the mapping relationship between the same real Internet Protocol address and different virtual Internet Protocol addresses, and there is a one-to-one correspondence between the virtual Internet Protocol address and the domain name to be accessed; and use the network address translation table to associate and map real address information and virtual address information to obtain the target mapping relationship.

[0106] Optionally, the traffic statistics device further includes: a filtering module 405, used to filter the same real Internet Protocol address corresponding to multiple domain names to be accessed in response to the domain name resolution result meeting the preset address conditions, and obtain the address filtering result; the return module 403 is also used to return the address filtering result to multiple applications.

[0107] Optionally, the statistics module 404 is further configured to: obtain initial traffic statistics results based on virtual address information, wherein the initial traffic statistics results are used to represent the upload traffic record results and download traffic record results corresponding to different virtual Internet Protocol addresses; and determine the target traffic statistics results using the target mapping relationship and the initial traffic statistics results.

[0108] Optionally, the acquisition module 401 is further configured to acquire the network data streams of multiple applications in response to multiple applications performing access operations based on virtual address information; the traffic statistics device further includes: a conversion module 406, configured to perform address conversion on the network data stream using a preset firewall tool to obtain an address conversion result, wherein the address conversion result is used to represent the result of converting the destination address of the network data stream from a virtual Internet Protocol address to a real Internet Protocol address; and a transmission module 407, configured to perform data transmission based on the address conversion result.

[0109] Embodiments of this application also provide a vehicle, including: a memory storing an executable program; and a processor for running the program, wherein the program executes the methods described in various embodiments of this application when it runs.

[0110] Embodiments of this application also provide a computer-readable storage medium including a stored executable program, wherein, when the executable program is running, it controls the device where the computer-readable storage medium is located to perform the methods of various embodiments of this application.

[0111] Embodiments of this application also provide a computer program product, including a computer program that, when executed by a processor, implements the methods of various embodiments of this application.

[0112] Embodiments of this application also provide a computer program product, including a non-volatile computer-readable storage medium for storing a computer program that, when executed by a processor, implements the methods in various embodiments of this application.

[0113] Embodiments of this application also provide a computer program that, when executed by a processor, implements the methods described in the various embodiments of this application.

[0114] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0115] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0116] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0117] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0118] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0119] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for traffic flow statistics, characterized in that, include: Obtain domain name query requests corresponding to multiple applications, wherein the domain name query requests include multiple domain names to be accessed corresponding to the multiple applications; A target mapping relationship is constructed based on the domain name query request, wherein the target mapping relationship is used to represent the mapping relationship between the domain name to be accessed, the real Internet Protocol address, and the virtual Internet Protocol address; Virtual address information is returned to the plurality of applications according to the target mapping relationship, wherein the virtual address information is used to guide the plurality of applications to access data; In response to the multiple applications performing access operations based on the virtual address information, traffic statistics are performed based on the virtual address information to obtain target traffic statistics results, wherein the target traffic statistics results are used to represent the traffic usage details information corresponding to the multiple domain names to be accessed.

2. The flow rate statistics method according to claim 1, characterized in that, Constructing the target mapping relationship based on the domain name query request includes: The domain name query request is parsed to obtain the domain name resolution result, wherein the domain name resolution result is used to determine the real address information corresponding to multiple domain names to be accessed; In response to the domain name resolution result meeting the preset address conditions, the target mapping relationship is constructed based on the multiple domain names to be accessed, the real address information, and the virtual address information, wherein the preset address conditions are used to determine that the real Internet Protocol addresses corresponding to the multiple domain names to be accessed are the same.

3. The flow rate statistics method according to claim 2, characterized in that, In response to the domain name resolution result conforming to the preset address condition, constructing the target mapping relationship based on the plurality of domain names to be accessed, the real address information, and the virtual address information includes: In response to the domain name resolution result meeting the preset address conditions, a network address translation table is created, wherein the network address translation table is used to construct a mapping relationship between the same real Internet Protocol address and different virtual Internet Protocol addresses, and the virtual Internet Protocol addresses correspond one-to-one with the domain name to be accessed; The target mapping relationship is obtained by associating and mapping the real address information and the virtual address information using the network address translation table.

4. The flow rate statistics method according to claim 2, characterized in that, The traffic statistics method also includes: In response to the domain name resolution result matching the preset address condition, the same real Internet Protocol address corresponding to the multiple domain names to be accessed is filtered to obtain the address filtering result; The address filtering results are returned to the multiple applications.

5. The flow rate statistics method according to claim 1, characterized in that, Based on the virtual address information, traffic statistics are performed to obtain the target traffic statistics results, including: Initial traffic statistics results are obtained based on the virtual address information, wherein the initial traffic statistics results are used to represent the upload traffic record results and download traffic record results corresponding to different virtual Internet Protocol addresses; The target traffic statistics are determined using the target mapping relationship and the initial traffic statistics.

6. The flow statistics method according to claim 1, characterized in that, The traffic statistics method also includes: In response to the plurality of applications performing access operations based on the virtual address information, the network data streams of the plurality of applications are obtained; The network data stream is address translated using a preset firewall tool to obtain an address translation result, wherein the address translation result is used to represent the result of converting the destination address of the network data stream from the virtual Internet Protocol address to the real Internet Protocol address; Data transmission is performed based on the address translation result.

7. A flow rate counting device, characterized in that, include: The acquisition module is used to acquire domain name query requests corresponding to multiple applications, wherein the domain name query requests include multiple domain names to be accessed corresponding to the multiple applications; A construction module is used to construct a target mapping relationship based on the domain name query request, wherein the target mapping relationship is used to represent the mapping relationship between the domain name to be accessed, the real Internet Protocol address, and the virtual Internet Protocol address; The return module is used to return virtual address information to the plurality of applications according to the target mapping relationship, wherein the virtual address information is used to guide the plurality of applications to access data; The statistics module is used to respond to the multiple applications performing access operations based on the virtual address information, perform traffic statistics based on the virtual address information, and obtain target traffic statistics results, wherein the target traffic statistics results are used to represent the traffic usage details information corresponding to the multiple domain names to be accessed.

8. A vehicle, characterized in that, include: Memory, which stores executable programs; A processor for running the program, wherein the program, when running, performs the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored executable program, wherein, when the executable program is executed, it controls the device on which the storage medium is located to perform the method according to any one of claims 1 to 6.

10. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method according to any one of claims 1 to 6.

Images