Method for constructing IP domain name association knowledge base based on DNS full record

Abstract

The application provides an IP domain name association knowledge base construction method based on DNS full records, comprising: acquiring DNS record data; standardizing the DNS record data into a unified format, including IP address, domain name and record type; constructing a graph database based on the current DNS record data; and using the graph database to perform IP address and domain name association information query and analysis operations. The application provides a graph database technical solution for comprehensively and accurately obtaining IP address and domain name association information. By acquiring and analyzing DNS full records, various complex association modes between IP addresses and domain names are established, such as one-to-one, one-to-many, many-to-one and hierarchical association. In the face of such complex relationship data, the graph database can provide efficient graph traversal, graph query and graph analysis capabilities. The knowledge base can be used to realize various practical application scenarios, such as network monitoring, malicious activity detection and network topology analysis.

Description

Technical Field

[0001] This invention relates to the field of DNS (Domain Name System) technology, and in particular to a method for constructing an IP domain name association knowledge base based on DNS full records. Background Technology

[0002] Current methods for obtaining the relationships between IP addresses and between IP addresses and domain names include IP address association methods based on network topology, IP domain name association knowledge base construction methods based on DNS server scanning, and IP domain name association knowledge base construction methods based on surveying website queries.

[0003] However, the above-mentioned technologies have at least the following problems that urgently need to be solved: (1) Limited association information: Existing technical solutions are limited to obtaining only the association between IPs or between IPs and domain names, ignoring other important DNS record types. This limits the comprehensive understanding of the network structure, making it difficult to distinguish different types of nodes, such as accurately identifying nodes with specific functions like mail servers.

[0004] (2) Inability to support multiple relationship types: Existing technical methods mainly rely on a single data source, such as the data packet transmission path, which means that they can only focus on the directional relationships of network communication. This limitation of a single data source makes it difficult to fully obtain the various IP domain name associations that actually exist in the network structure, such as one-to-one, one-to-many, many-to-one and hierarchical associations.

[0005] (3) Incomplete knowledge base construction results: The method of actively scanning DNS servers or querying surveying websites to construct IP domain name association information can only obtain the mapping relationship between the actually queried domain name and IP address, and cannot obtain the domain name information that has not been actively queried. In addition, some domain names adopt concealment methods, such as using CDN, proxy, etc., which also makes it difficult to identify their real IP address through simple DNS query, resulting in incomplete knowledge base construction results.

[0006] (4) The knowledge base is difficult to update in real time: The method of scanning and querying the mapping website based on the DNS server is carried out periodically, so there will be a delay in updating the IP domain name mapping relationship in the knowledge base. At the same time, the IP address association based on the network topology cannot be updated in real time with the dynamic changes in the network topology, such as the online and offline of devices, changes in network configuration, network interruption, etc. Summary of the Invention

[0007] The technical problem to be solved by this invention is how to comprehensively and accurately obtain a graph database of IP address and domain name association information; in view of this, this invention provides a method for constructing an IP domain name association knowledge base based on DNS full records.

[0008] The technical solution adopted in this invention is a method for constructing an IP domain name association knowledge base based on DNS full records, comprising: Step S1: Obtain DNS record data; Step S2: Standardize the DNS record data into a unified format, including IP address, domain name, and record type; Step S3: Construct a graph database based on the current DNS record data; Step S4: Use the graph database to perform query and analysis operations on the association information between IP addresses and domain names.

[0009] In one embodiment, step S1 includes: By analyzing passive traffic, the DNS record data is obtained and sent to the Kafka message queue in real time; The Kafka system distributes data to multiple consumers for parallel processing.

[0010] In one embodiment, the method further includes: The received DNS full record data is preprocessed, including: DNS full record data cleaning, removing duplicate data, deleting abnormal data and invalid data.

[0011] In one implementation, step S3 includes: Based on the domain name and IP address information obtained from the resolution, create nodes in the graph database; Configure a relationship model based on the relationship between the domain name and the IP address.

[0012] In one implementation, the relationship between the domain name and the IP address includes: One IP address corresponds to one domain name; One domain name can correspond to multiple IP addresses; Multiple domain names correspond to one IP address; Establish parent-child node relationships based on the hierarchical structure of domain names.

[0013] In one embodiment, step S4 includes at least one of the following: Path query: Find the path between a specific IP address and domain name in the graph database, including all possible intermediate nodes and path attributes; Relationship analysis: Using the graph database, different types of relationship patterns are analyzed to identify important nodes and critical paths in the network topology; Visualization Analysis: Using the visualization tools and integrated visualization library of the graph database, the query results are displayed in a graphical manner.

[0014] Another aspect of the present invention provides an apparatus for constructing an IP domain name association knowledge base based on DNS full records, comprising: The acquisition unit is configured to acquire DNS record data; The preprocessing unit is configured to standardize the DNS record data into a uniform format, including IP address, domain name, and record type; The building unit is configured to build a graph database based on the current DNS record data; The query unit is configured to use the graph database to perform query and analysis operations on IP address and domain name association information.

[0015] Another aspect of the present invention provides an electronic device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the method for constructing an IP domain name association knowledge base based on DNS full records as described in any of the preceding claims.

[0016] Another aspect of the present invention provides a computer storage medium storing a computer program, which, when executed by a processor, implements the steps of the method for constructing an IP domain name association knowledge base based on DNS full records as described in any of the preceding claims.

[0017] Compared with the prior art, the present invention has at least the following advantages: This invention provides a graph database technology solution for comprehensively and accurately acquiring information on the association between IP addresses and domain names. By acquiring and analyzing full DNS records, various complex associations between IP addresses and domain names are established, such as one-to-one, one-to-many, many-to-one, and hierarchical associations. Faced with such complex relational data, the graph database provides efficient graph traversal, graph query, and graph analysis capabilities. This knowledge base can be used to implement various practical application scenarios, such as network monitoring, malicious activity detection, and network topology analysis. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the method for constructing an IP domain name association knowledge base based on DNS full records according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the Kafka data flow according to an embodiment of the present invention; Figure 3 This is a schematic diagram of IP and domain name node information according to an embodiment of the present invention; Figure 4 This is a schematic diagram illustrating the one-to-one relationship between domain name nodes and IP nodes in an embodiment of the present invention. Figure 5This is a schematic diagram illustrating the one-to-many mapping relationship between domain name nodes and IP nodes according to an embodiment of the present invention; Figure 6 This is a schematic diagram illustrating the many-to-one mapping relationship between domain name nodes and IP nodes according to an embodiment of the present invention; Figure 7 This is a schematic diagram of the hierarchical structure between domain name nodes in an embodiment of the present invention; Figure 8 This is a schematic diagram illustrating the data flow logic between Kafka and R-CRNA in an embodiment of the present invention. Figure 9 This is a schematic diagram of the composition structure of the IP domain name association knowledge base construction device based on DNS full record according to an embodiment of the present invention; Figure 10 This is a schematic diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0019] To further illustrate the technical means and effects of the present invention in achieving its intended purpose, the present invention will be described in detail below with reference to the accompanying drawings and preferred embodiments.

[0020] Unless otherwise specified, all terms used herein (including technical and scientific terms) shall have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains. It should also be understood that terms (e.g., those defined in common dictionaries) shall be interpreted as having the meaning consistent with their meaning in the context of the relevant art and shall not be interpreted in an idealized or overly formal sense unless expressly so specified herein.

[0021] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0022] For ease of understanding, the technical terms used in this application will be explained below.

[0023] (1) DNS is a fundamental service on the Internet used for mapping domain names to IP addresses. In the traditional DNS system, when a user enters a domain name, the system returns the corresponding IP address through a domain name resolution query. This basic domain name resolution process plays a key role in Internet communication, but its records are limited to a simple correspondence between domain names and IP addresses.

[0024] (2) DNS full record technology is an extension of traditional DNS, aiming to record the relationship between domain names and IP addresses more comprehensively. Compared with the traditional DNS system, which provides more comprehensive domain name resolution functions, DNS full record technology provides more detailed and comprehensive association information through various record types, including A records, AAAA records, CNAME records, MX records, NS records, TXT records, and SOA records. This gives DNS full record technology a potential advantage in building a knowledge base for the association between domain names and IP addresses.

[0025] (3) As a type of graph database, graph databases have the characteristics of high dimensionality, high performance, and high efficiency compared to traditional relational databases. In graph databases, data is organized in the form of a graph, where nodes represent entities and edges represent relationships between entities. This data model is particularly suitable for processing datasets with complex relationships, such as social networks, knowledge graphs, and network topologies. Graph databases support faster, deeper, and more accurate mining of relationships between things. As the search depth increases, the improvement in performance and efficiency increases exponentially, making it more flexible and efficient in analyzing and exploring relational data.

[0026] (4) Kafka Distributed Stream Processing Platform: Known for its high reliability, high throughput, and horizontal scalability. It adopts a publisher-subscriber model, supporting the publication of messages to specific topics and real-time subscription for processing, while providing persistent storage and recoverability to ensure that data can be safely transmitted and processed even under high load and failure conditions. Kafka's streaming processing capabilities make it an indispensable component of real-time data pipelines, log aggregation, and event-driven architectures.

[0027] This invention provides a method for constructing an IP domain name association knowledge base based on DNS full records, such as... Figure 1 As shown, it includes: Step S1: Obtain DNS record data; Step S2: Standardize the DNS record data into a unified format, including IP address, domain name, and record type; Step S3: Construct a graph database based on the current DNS record data; Step S4: Use the graph database to perform query and analysis operations on the association information between IP addresses and domain names.

[0028] The method provided in this embodiment will be described in detail step by step below.

[0029] Step S1: Obtain DNS record data.

[0030] refer to Figure 2This embodiment employs a real-time stream processing approach integrated with Kafka. Network traffic analysis scripts are written using the Zeek network analytics framework to monitor network traffic in real time and send the results to the Kafka message queue. Kafka is then used to process large volumes of real-time data streams, aggregating data from different sources (producers) and transmitting it to multiple consumers for processing.

[0031] 1) Data source access: DNS resolution record data is obtained by analyzing passive traffic and sent to the Kafka message queue in real time.

[0032] 2) Message distribution: Kafka distributes data to multiple consumers for parallel processing through partitioning and replication mechanisms, ensuring high availability and reliability of the data.

[0033] 3) Data Transformation: The received DNS record data is processed and transformed in real time using a stream processing framework to meet the format requirements of the graph database. The Kafka Streams framework is used to clean, filter, and aggregate the received DNS record data for subsequent import into the graph database.

[0034] Step S2: Standardize the DNS record data into a unified format, including IP address, domain name, and record type.

[0035] In this embodiment, the process begins by analyzing passive traffic to obtain complete DNS records, including A records, AAAA records, CNAME records, MX records, NS records, TXT records, and SOA records, to obtain comprehensive association information between IP addresses and domain names. The received complete DNS record data is then processed: the collected DNS records are cleaned, duplicate data is removed, abnormal and invalid data are processed, and the records are standardized into a unified format, including information such as IP address, domain name, and record type.

[0036] 1) Preprocessing: Before the data enters the formal cleaning process, basic preprocessing is performed, including formatting transformation, data parsing, and preliminary anomaly detection. Python regular expressions are used to efficiently extract domain names, IP addresses, and other necessary information from the raw data. Then, data processing scripts are written based on the characteristics of the data source to process specific log file formats or network traffic packets.

[0037] 2) Deduplication: Since data may be collected from multiple sources, deduplication is necessary to ensure the uniqueness of each record. A distributed hash table is used to store the processed data, and then a Bloom filter is used to efficiently filter out potentially duplicate data.

[0038] 3) Anomaly Handling: In real-world data, common anomalies include invalid domain names or IP address formats, missing key fields, etc. Special handling is required for these anomalies to ensure data integrity and accuracy. Each record is validated and filtered using predefined data validation rules, including regular expressions and data format requirements. Then, automated scripts are written to detect and correct malformed IP addresses or domain names.

[0039] 4) Data Standardization: Standardize the cleaned data into a uniform format to ensure that each record contains the necessary information and that the format is consistent, facilitating subsequent analysis and storage. A data transformation script written in Python is used to unify data from various formats into a specified data structure.

[0040] Step S3: Construct a graph database based on the current DNS record data.

[0041] Neo4j graph database emphasizes the relationships between nodes (entities or objects) (connections between nodes). In this scenario, nodes are first defined to represent domain names and IP addresses, then a relational model is designed, clarifying the representation methods for different association types. This technical solution combines the data storage of a graph database with the design of a complex relational model, using the "Real-time Comprehensive Relationship Network Analysis (R-CRNA)" algorithm, and integrating Kafka to achieve real-time data stream processing, enabling in-depth analysis and real-time response to large-scale network structures and complex relationships. The specific construction steps are as follows.

[0042] 1) Construct a graph database i) Create Nodes: Based on the resolved domain name and IP address information, create corresponding nodes in the graph database and store the resolved data in the graph database. Choose Neo4j database to build the graph database and use the Cypher query language to manipulate and manage the graph data. For example... Figure 3 The image shows IP address and domain name node information.

[0043] ii) Design the relational model Establish a one-to-one relationship: such as Figure 4 As shown, one IP address corresponds to one domain name. By traversing and resolving the data, a relationship is established between an IP address node and a domain name node for each one-to-one relationship. For example... Figure 2 As shown, a many-to-one relationship is established between domain name nodes and IP nodes.

[0044] Domain name node: abc.com IP address: 192.168.1.1 Relationship: abc.com resolves to 192.168.1.1 Establishing a one-to-many relationship: For example Figure 5 As shown, this means one domain name corresponds to multiple IP addresses, suitable for server load balancing. By traversing and resolving the data, for a one-to-many relationship, a relationship is established between the domain name node and multiple IP address nodes. For example... Figure 3 As shown, this is a one-to-many mapping from domain name nodes to IP nodes.

[0045] Domain name node: abc.com IP address nodes: 192.168.1.1, 192.168.1.2 Relationship: abc.com resolves to multiple IP addresses: 192.168.1.1, 192.168.1.2 Establishing a many-to-one relationship: For example Figure 6 As shown, multiple domain names correspond to one IP address, suitable for situations where the same service or resource is shared. By traversing and resolving the data, for many-to-one relationships, a relationship is established between multiple domain name nodes and one IP address node. For example... Figure 4 As shown, this is a many-to-one mapping from domain name nodes to IP nodes.

[0046] Domain names: abc.com, sub.abc.com IP address: 192.168.1.1 Relationship: Both abc.com and sub.abc.com resolve to the same IP address: 192.168.1.1 Establish hierarchical relationships: such as Figure 7 As shown, establishing parent-child node relationships based on the hierarchical structure of domain names is suitable for domain name systems with a clear organizational structure. By traversing and resolving the data, domain name nodes are created in the graph database, and parent-child relationships are determined according to the hierarchical structure of the domain names. For example... Figure 5 As shown, this is the hierarchical structure between domain name nodes.

[0047] Domain names: example.com, sub.example.com IP address: 192.168.1.1 Relationship: example.com owns the subdomain sub.example.com, and sub.example.com resolves to the same IP address: 192.168.1.1 2) Real-time data import and update The Real-time Comprehensive Relationship Network Analysis (R-CRNA) algorithm supports the rapid and accurate establishment and updating of complex relationships between IP addresses and domain names in large-scale network environments by capturing and analyzing network communication data in real time. The main steps are as follows: i) Real-time data import and update: Real-time data is read from the message queue using a Kafka consumer and imported into the graph database in real time. This ensures fast data response and real-time updates. The Kafka Streams streaming framework is used to convert received DNS resolution record data into a format that the graph database can process. This ensures real-time data import and updates through the streaming framework, maintaining the synchronization of data in the graph database with the actual network state.

[0048] ii) Complex Relationship Model Definition and Management: Utilizing the flexible data model of the Neo4j graph database, complex network topology relationships are managed, including one-to-one, one-to-many, many-to-many, and multi-level relationships. It also supports adding attributes to nodes and relationships, enhancing data expressiveness and query efficiency. A real-time data import mechanism allows for timely updates and adjustments to the complex relationship model to reflect real-time changes in the network topology.

[0049] iii) Real-time Analysis and Prediction: Real-time analysis and prediction of network topology are performed using a real-time stream processing framework. This includes monitoring the addition of new nodes, changes in critical paths, and predicting future network structure trends. Stream processing algorithms are used to aggregate, filter, and compute real-time data streams to extract key indicators and anomalies.

[0050] Step S4: Use the graph database to perform query and analysis operations on the association information between IP addresses and domain names.

[0051] Leveraging the powerful query capabilities of graph databases, this tool performs queries and analysis of IP address and domain name association information. Neo4j uses nodes and edges to represent data, a model well-suited for representing complex relationships between entities. Each node can contain attributes, and edges can have direction and type, making the data model more expressive and flexible. Cypher, Neo4j's query language, supports rich pattern matching and graph traversal capabilities, enabling complex graph queries and analysis operations, such as finding paths between nodes and calculating node degrees.

[0052] like Figure 8 As shown, the following operations can be performed using Cypher query language or a similar graph query language: 1) Path lookup: Find the path between a specific IP address and a domain name, including all possible intermediate nodes and path attributes.

[0053] 2) Relationship Analysis: Analyze different types of relationship patterns, such as one-to-one, one-to-many, many-to-one, and many-to-many relationships, to reveal important nodes and critical paths in the network topology.

[0054] 3) Visualization Analysis: Utilizing the visualization tools and integrated visualization library of the graph database, query results are displayed graphically to help users understand the network structure and relationships more intuitively.

[0055] Compared with the prior art, this embodiment has at least the following advantages: (1) This application aims to provide more comprehensive and accurate IP domain name association information by obtaining full DNS record information and constructing a graph database to process complex network topologies. By obtaining various DNS record types such as A records, CNAME records, and MX records, the complex relationship between IP addresses and domain names can be better reflected, and a comprehensive understanding of the network structure can be achieved.

[0056] (2) This application proposes a deep association analysis method based on the Neo4j graph database, which can handle complex network topologies, including various relationship types. By establishing various associations between IP addresses and domain names, such as one-to-one, one-to-many, many-to-one, and hierarchical associations, it can better reflect the complex IP domain name relationships in the real world.

[0057] (3) This application proposes to use passive traffic analysis technology to update the IP domain name association knowledge base in real time. Through real-time stream processing and Kafka integration, it can directly reflect the real communication behavior in the network, including actual domain name resolution requests and data packet transmission paths. By analyzing passive traffic, all traffic on the network can be captured, making the obtained IP domain name associations more comprehensive, thereby achieving the comprehensiveness of the knowledge base construction results.

[0058] (4) This application proposes to build and update the database based on the Real-time Comprehensive Relational Network Analysis (R-CRNA) algorithm. By analyzing passive traffic, the IP domain name association knowledge base is updated in real time, directly reflecting the actual communication behavior in the network, capturing all traffic to obtain a more comprehensive IP domain name association, ensuring the real-time and accuracy of the association information, and responding to the dynamic changes in the network topology.

[0059] The second embodiment of the present invention corresponds to the first embodiment, as described above. Figure 9 This embodiment introduces an IP domain name association knowledge base construction device based on DNS full records, which includes the following components: The acquisition unit is configured to acquire DNS record data; The preprocessing unit is configured to standardize the DNS record data into a uniform format, including IP address, domain name, and record type; The building unit is configured to build a graph database based on the current DNS record data; The query unit is configured to use the graph database to perform query and analysis operations on IP address and domain name association information.

[0060] In this embodiment, the acquisition unit is specifically configured as follows: By analyzing passive traffic, the DNS record data is obtained and sent to the Kafka message queue in real time; The Kafka system distributes data to multiple consumers for parallel processing.

[0061] In this embodiment, the device is further used for: The received DNS full record data is preprocessed, including: DNS full record data cleaning, removing duplicate data, deleting abnormal data and invalid data.

[0062] In this embodiment, the building unit is specifically configured as follows: Based on the domain name and IP address information obtained from the resolution, create nodes in the graph database; Configure a relationship model based on the relationship between the domain name and the IP address.

[0063] In this embodiment, the relationship between the domain name and the IP address includes: One IP address corresponds to one domain name; One domain name can correspond to multiple IP addresses; Multiple domain names correspond to one IP address; Establish parent-child node relationships based on the hierarchical structure of domain names.

[0064] In this embodiment, the processing of the query unit includes at least one of the following: Path query: Find the path between a specific IP address and domain name in the graph database, including all possible intermediate nodes and path attributes; Relationship analysis: Using the graph database, different types of relationship patterns are analyzed to identify important nodes and critical paths in the network topology; Visualization Analysis: Using the visualization tools and integrated visualization library of the graph database, the query results are displayed in a graphical manner.

[0065] A third embodiment of the present invention provides an electronic device, such as... Figure 10As shown, it can be understood as a physical device, including a processor and a memory storing processor-executable instructions. When the instructions are executed by the processor, the following operations are performed: Step S1: Obtain DNS record data; Step S2: Standardize the DNS record data into a unified format, including IP address, domain name, and record type; Step S3: Construct a graph database based on the current DNS record data; Step S4: Use the graph database to perform query and analysis operations on the association information between IP addresses and domain names.

[0066] In the fourth embodiment of the present invention, the process of constructing an IP domain name association knowledge base based on DNS full records is the same as that of the first, second, or third embodiments. The difference lies in the engineering implementation: this embodiment can be implemented using software plus necessary general-purpose hardware platforms. While hardware can also be used, the former is often a better implementation method. Based on this understanding, the method of the present invention can be embodied in the form of a computer software product stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), including several instructions to cause a device to execute the method described in the embodiments of the present invention.

[0067] Through the description of specific embodiments, a more in-depth and specific understanding should be gained of the technical means and effects adopted by the present invention to achieve the intended purpose. However, the accompanying drawings are only provided for reference and illustration and are not intended to limit the present invention.

Claims

1. A method for constructing an IP domain name association knowledge base based on DNS full records, characterized in that, include: Step S1: Obtain DNS record data; Step S2: Standardize the DNS record data into a unified format, including IP address, domain name, and record type; Step S3: Construct a graph database based on the current DNS record data; Step S4: Use the graph database to perform query and analysis operations on the association information between IP addresses and domain names.

2. The method for constructing an IP domain name association knowledge base based on DNS full records according to claim 1, characterized in that, Step S1 includes: By analyzing passive traffic, the DNS record data is obtained and sent to the Kafka message queue in real time; The Kafka system distributes data to multiple consumers for parallel processing.

3. The method for constructing an IP domain name association knowledge base based on DNS full records according to claim 1, characterized in that, The method further includes: The received DNS full record data is preprocessed, including: DNS full record data cleaning, removing duplicate data, deleting abnormal data and invalid data.

4. The method for constructing an IP domain name association knowledge base based on DNS full records according to claim 1, characterized in that, Step S3 includes: Based on the domain name and IP address information obtained from the resolution, create nodes in the graph database; Configure a relationship model based on the relationship between the domain name and the IP address.

5. The method for constructing an IP domain name association knowledge base based on DNS full records according to claim 4, characterized in that, The relationship between the domain name and the IP address includes: One IP address corresponds to one domain name; One domain name can correspond to multiple IP addresses; Multiple domain names correspond to one IP address; Establish parent-child node relationships based on the hierarchical structure of domain names.

6. The method for constructing an IP domain name association knowledge base based on DNS full records according to claim 1, characterized in that, The process in step S4 includes at least one of the following: Path query: Find the path between a specific IP address and domain name in the graph database, including all possible intermediate nodes and path attributes; Relationship analysis: Using the graph database, different types of relationship patterns are analyzed to identify important nodes and critical paths in the network topology; Visualization Analysis: Using the visualization tools and integrated visualization library of the graph database, the query results are displayed in a graphical manner.

7. A device for constructing an IP domain name association knowledge base based on DNS full records, characterized in that, include: The acquisition unit is configured to acquire DNS record data; The preprocessing unit is configured to standardize the DNS record data into a uniform format, including IP address, domain name, and record type; The building unit is configured to build a graph database based on the current DNS record data; The query unit is configured to use the graph database to perform query and analysis operations on IP address and domain name association information.

8. An electronic device, characterized in that, The electronic device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the computer program is executed by the processor, it implements the steps of the method for constructing an IP domain name association knowledge base based on DNS full records as described in any one of claims 1 to 6.

9. A computer storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of the method for constructing an IP domain name association knowledge base based on DNS full records as described in any one of claims 1 to 6.

Images