2108 results about "Domain name" patented technology

The invention discloses a domain name information processing and displaying method based on multi-modal data fusion, and the method comprises the following steps: S1, collecting and preprocessing domain name multi-modal original data, and generating a preprocessed data sample set; s2, performing feature extraction on the preprocessed data sample set, and constructing a multi-modal fusion feature vector sequence; s3, constructing an initial Tab Net model, and outputting an initial domain name risk prediction result; s4, constructing a model performance evaluation objective function; s5, introducing a dragonfly optimization algorithm, and searching to obtain an optimal Tab Net parameter combination; and S6, based on the optimal Tab Net parameter combination, obtaining an optimized Tab Net model, and outputting a final domain name risk prediction result. And S7, based on the final domain name risk prediction result, constructing a domain name knowledge graph display structure, and generating an interactive graph display result. According to the method, a multi-modal feature extraction mechanism, a Tab Net depth model and a dragonfly optimization algorithm are fused, and intelligent prediction of domain name risks and interactive knowledge graph display optimization are realized.

The method and systems for automatically identified currently viewing website domain name or a uniform resource locator (URL), receiving, by the server, said automatically identified website domain name or the uniform resource locator (URL), a request or an invitation for initiating a communication including live chat, puts the request for initiating a communication including live chat from the first user and the second user in a communication including live chat queue of the website or the uniform resource locator (URL) associated account, for available or identified or relevant agents to pick up, routing request or invitation for initiating a communication including live chat from the first user and the second user according to a pre-set rules and start a communication including live chat by available agent by selecting particular request for initiating a communication including live chat from the queued communication including live chats.

To solve the problems of fractured identity across multiple blockchains, these methods and systems allow for a single unified identity to be managed and resolved across multiple chains within an interop network. By leveraging message passing, identity records can exist securely across different chains. The system incorporates counterfactual blockchains, enabling trust-minimized name registration that reduces costs while maintaining decentralization and security. ENS name resolution is supported across both onchain and offchain environments, with verifiable proofs ensuring efficient resolution. By structuring message passing and utilizing decentralized indexers, these methods and systems provide a scalable and reliable framework for cross-chain identity.

Some embodiments enhance the security of domain name resolution and other DNS operations, by automatically intercepting the DNS operation, determining an associated device identity or ascertaining an associated user identity, and enforcing a security policy based on at least the DNS operation and based on at least one of the identities. Some securable DNS operations include resolution requests, reverse lookups from IP addresses to domain names, DNS record accesses, mail server mappings, redirection, forwarding, and DNS record cache operations. Enforcing the policy includes, e.g., preventing a result requested by the DNS operation, permitting computational progress toward the requested result, allowing a different result, modifying a DNS record, or flushing a DNS record from a cache. In some embodiments, DNS operation security functionality utilizes or implements a conditional access security functionality, thereby providing, e.g., a secure conditional domain name resolution.

The concepts and technologies disclosed herein are directed to continuous external risk assessment for Internet-facing assets. In one or more implementations, a system can execute a web crawl using a plurality of seed uniform resource locators. The system can execute a domain name service subdomain scan and a subdomain scan. The system can obtain asset data associated with one or more client assets. The system can determine, based upon the asset data and results of the web crawl, the domain name service subdomain scan, and the subdomain scan, whether each domain of a plurality of domains is known.

The invention relates to the technical field of network communication, provides a dual-stack network adaptive scheduling method and system based on a DNS analysis strategy, and is used for establishing an effective protocol stack feature association mechanism so as to realize cross-protocol-layer intelligent scheduling. The method comprises the steps that a DNS analysis request sent by a client side is received, and the DNS analysis request carries a target domain name and a request protocol type; analyzing the request protocol type to determine a network protocol stack type supported by the client; generating an adaptive scheduling strategy corresponding to the target domain name according to the network protocol stack type and a preset address type priority list; selecting a target IP address type from a pre-configured IP address pool based on the self-adaptive scheduling strategy; and returning an analysis result corresponding to the target IP address type to the client so as to guide the client to establish network connection through the target IP address type.

The invention provides a cross-platform network speed measurement and adaptive path switching method and device and a storage medium. The method comprises the following steps: receiving a target domain name and a multi-source DNS server list; extracting historical network quality data corresponding to the environment identifier and each candidate IP address, inputting the historical network quality data into a link quality prediction model to obtain a prediction score of each candidate IP address, and screening according to a preset threshold to obtain a target IP subset; performing active detection of limited times on each IP address in the target IP subset to obtain a detection index; calculating the comprehensive score of each IP address based on the prediction score and the detection index, determining the optimal IP address with the highest comprehensive score, and recording the DNS server address of the optimal IP address; and establishing a network connection path according to the optimal IP address, and providing a DNS server address of the optimal IP address for a service layer. According to the method and the device, the cross-platform maintenance cost can be reduced, the real-time performance and the performance overhead are considered, the path is dynamically optimized, and rapid connection switching is realized.

HyperText Markup Language (HTML) content analysis (HCA) using machine learning is described. A feature vector schema may be generated based on domain names corresponding to HTML webpages and corresponding indications of a status of the HTML webpage. The schema may map each position in a feature vector of a given HTML webpage to a resource identifier. Information may be processed using the schema to generate respective feature vectors. The feature vectors may be used to train a model to generate risk indicators for HTML webpages. A potentially parked domain webpage or a potentially malicious domain webpage may be received. A feature vector for the webpage may be generated and inputted to the model. The model may generate a risk indicator for the webpage. The risk indicator may be output and may cause responsive actions. The model may be updated based on a determination indicating whether the webpage was a parked domain webpage or a malicious domain webpage.

A route selection method for an Edge Application Server (EAS) is provided, the method is performed by a terminal, and includes: receiving a Domain Name System (DNS) information indication sent by a first network function; executing a DNS policy decision based on the DNS information indication; and sending a DNS query request to a second network function based on the decision, where the DNS query request is used to request the second network function to select an EAS.

The invention relates to a QUIC protocol-based distributed node unified identity authentication method and system, belongs to the technical field of network security, is applied to a client, and comprises the following steps: registering a client domain name identity through a certificate authority, obtaining a client certificate, and pre-storing a server certificate chain; generating a QUIC initial data packet according to the target server domain name identifier and the client certificate, and sending the QUIC initial data packet to the server; receiving a QUIC handshake data packet returned by the server; verifying the legality of the server certificate based on the server certificate chain, and if the server certificate is legal, calculating a pre-master key according to the client DH private key and the server DH public key; deriving a 1-RTT session key based on the pre-master key; generating a signature verification message, and sending the client certificate and the signature verification message to a server; and synchronously using the 1-RTT session key to encrypt the application layer data with the server, and transmitting the data to the server in the 1-RTT encryption space of the QUIC protocol. According to the invention, the reliability of node identities and the confidentiality of data are ensured.

Techniques for visual deep learning for inline phishing detection are disclosed. In some embodiments, a system / process / computer program product for visual deep learning for inline phishing detection includes extracting a logo from a screenshot of a web page; detecting phishing based on a match to at least one of a plurality of reference logos using a visual deep learning model and that a domain associated with the web page is not associated with an entity that matches the logo extracted from the web page; and performing a remedial action in response to determining that the web page is associated with phishing.

The invention relates to a fraud website identification early warning method, device and equipment and a storage medium thereof. The method comprises the following steps: firstly, acquiring network address information, then extracting feature data from dimensions such as structure, semantics, behavior and vision, accelerating similarity detection by applying a graphics processor parallel computing technology, and generating a composite feature vector containing a domain name similarity score and a registration feature; constructing fraud features in combination with the composite feature vector, mining a data association relationship through a graph neural network, and forming multi-dimensional risk feature data; and finally, processing the risk feature data by using a deep learning model, generating a risk probability, and when the risk probability exceeds a preset threshold, determining that the network address is a high-risk network address and generating an early warning report. By adopting the method, the comprehensiveness and accuracy of fraud website identification can be improved, complex fraud means such as domain name variation and semantic camouflage can be effectively dealt with, the real-time early warning capability for potential risks is enhanced, and efficient technical support is provided for network security protection.

The invention relates to a DevOps-oriented containerized test environment deployment system and method, and belongs to the technical field of Internet. A multi-service test environment is defined through a YAML file, environment variables are managed in combination with an. Env configuration file, dependency is optimized through dependency layering and a cache library, a container mirror image is constructed, and a container cluster is started; managing multiple tasks through a centralized scheduling architecture, and realizing resource isolation of a container cluster by using Cgroup; adjusting the number of container instances in real time based on a capacity expansion and contraction mechanism; a bridging network is used for automatically distributing a container IP, a built-in domain name system analyzes a service name dynamic discovery service, and rapid reconstruction of a containerized test environment is achieved. According to the method, a YAML and environment variable separation mechanism is adopted, real-time loading of development, testing and production environment configuration is supported, the deployment time is shortened to the second level, the resource utilization rate is increased to 90% from 60%, the multi-service communication difference is eliminated, and efficient interconnection between containers is ensured.

The invention discloses a DNS anomaly detection and domain name hijacking early warning method based on a multi-source NLP, and belongs to the technical field of network security. According to the method, firstly, multi-source information collection and NLP semantic analysis are carried out, malicious entities are identified from collected external information, and an attack mode is reasoned; performing association scoring on the identified malicious entity and an abnormal mode detected in a preset time window, if the score exceeds a threshold value, judging that a domain name hijacking behavior or a DNS poisoning behavior exists, executing a domain name hijacking early warning process, and storing an abnormal event log; and updating a multi-source information acquisition and NLP semantic analysis module and a DNS anomaly detection model according to feedback of a system alarm result, a log and sample data output by information association analysis and hijacking judgment. According to the invention, domain name hijacking and DNS abnormity can be quickly found, accurately positioned and timely warned, and false alarm and missing alarm are reduced.

The invention discloses a multi-modal attack identification method fusing BMama and difference to guide trans-attention, which comprises the following steps: simulating a false data injection attack, a denial of service attack, an address resolution protocol spoofing attack and a domain name system spoofing attack, collecting physical layer sensor data and network layer flow data, and preprocessing multi-modal data; bMama is constructed to perform dynamic time modeling on multi-modal data, a graph neural network is combined to adversariate a variational auto-encoder, features of a power grid system topology and a communication topology structure are fused, and robustness of potential representation is enhanced through adversarial training; the method comprises the following steps of: guiding feature complementary fusion by using modal difference through a difference guide iteration cross-attention fusion mechanism, improving the capability of distinguishing complex attacks, finally carrying out attack detection and classification on fused modals, and executing end-to-end optimization according to a weighted combination of loss of each part. The method can effectively detect and classify the multi-modal attack in the smart power grid, and enhances the safety and reliability of a complex system.

The invention relates to the technical field of abnormal domain name detection, in particular to an abnormal domain name detection system based on machine learning, which comprises a data processing and feature extraction module, a model training and updating module, a real-time detection and classification module, a family clustering and analysis module and an active defense and response module. Compared with a traditional abnormal domain name detection system which usually depends on a small number of characteristics such as character frequency and domain name length for detection and is difficult to comprehensively capture abnormal characteristics of domain names, the abnormal domain name detection system has the advantages that multi-modal characteristics such as character statistics, semantic characteristics and context behavior characteristics are extracted; in addition, the weight of each feature is dynamically adjusted through an attention mechanism, the problem that a single feature is easy to avoid is solved, high-uncertainty samples are screened through an active learning selector to update a training set, the problem of sample imbalance is solved, and the generalization ability of the model is improved.

The invention relates to the technical field of computers, and discloses a method and system for dynamically routing a back-end address by an API gateway, and the method comprises the steps: receiving an HTTP request, and analyzing a URL and a request header; extracting a tenant identifier, and supporting multi-mode identification of a request header, a sub-domain name or a path segment; loading an exclusive routing rule set based on the tenant identifier; sorting according to local priorities in the tenants, executing longest path prefix matching through a prefix tree, and determining an optimal back-end address; and finally forwarding the request. The system comprises a request analysis module, a tenant identification module, a rule loading module, a local sorting module, a longest matching module and a request forwarding module, and supports routing rule hot update and conflict detection. According to the method, cross-tenant interference is effectively eliminated through tenant context awareness and a two-stage matching mechanism, and the routing accuracy and the system isolation are improved.

Method and apparatus for improvement of DNS configuration for applications are disclosed. A method performed at a server comprises generating Domain Name System (DNS) information; deciding whether to transmit the DNS information to a User Equipment (UE) or to a network or to both the UE and the network; and transmitting the DNS information for use with at least one application associated with the UE according to the decision.

A method for processing a domain name resolution request is provided. The method includes: obtaining first request information of a first domain name resolution request sent by a target client, wherein the first request information comprises a domain name to be resolved carried in the first domain name resolution request, and client information of the target client; obtaining a first information set from a second server, in response to determining that first target node information corresponding to the first request information is not stored in the first server based on the domain name to be resolved and the client information, wherein the first information set is a collection of first candidate node information corresponding to the first request information; taking at least one first candidate node information in the first information set as the first target node information, and sending the first target node information to the target client.

A secure web gateway for a cloud computing environment comprises a data plane component, comprising: a front-end domain name service (DNS) configured to receive an inbound DNS request and map an IP address of the DNS request to a policy identification value corresponding to a customer policy and a plurality of plugin modules utilized by the front-end DNS to process the DNS request according to the mapping of the IP address from which the DNS request originates to the policy identification value. The secure web gateway further comprises a control plane component that provides the customer policy to the front-end DNS and configures the IP address to permit access to a DNS service according to the customer policy.

Disclosed are systems and methods that monitor for malicious and unauthorized behaviors, determine categories for detected malicious behaviors, determine why a domain is determined to be malicious, and provide information to users that identifies the categories and reasons as to why a domain is determined to be malicious. In some implementations, the disclosed systems and methods may be utilized to provide monitoring security to customers of a cloud service. For example, customers of a cloud service may maintain an account with the cloud service and the disclosed implementations may be utilized to protect those accounts from malicious attacks and cybercrimes such as, but not limited to, spam, phishing, malware, botnets, etc.

The invention discloses a data processing method and device, equipment and a medium. The method comprises the steps that a detection threshold value is determined based on a first access traffic log; determining an access behavior for the service domain name based on the number of domain name requests determined by the access traffic indicated by the second access traffic log and a detection threshold; when the access behavior aiming at the service domain name belongs to the abnormal access behavior, taking a behavior determination time point corresponding to the abnormal access behavior as a critical time point, and taking a third access traffic log obtained based on the critical time point as an abnormal access traffic log; when a normal traffic feature determined based on the first access traffic log is obtained, determining an abnormal traffic feature of the service domain name based on the abnormal access traffic log, and performing feature comparison on the abnormal traffic feature and the normal traffic feature to obtain an attack feature of the service domain name; a protection policy for the service domain name is determined based on the attack feature. According to the invention, the security and stability of the business server can be maintained.

Anycast addressing is utilized to support the connection of multiple application connectors fronting an application(s) to a network element and anycast routing of network traffic destined for the application(s). When an application is indicated for onboarding in a network fabric of a tenant, a network controller allocates virtual and anycast addresses to the application. Allocation of anycast addresses is per domain name and port / protocol combination. Upon determining that the application is available, the application connector(s) advertises reachability of the application via the anycast address. The network controller orchestrates configuration of a DNS entry that resolves the application name to its virtual IP address and destination NAT rules that translate the virtual IP address to the anycast address and the anycast address to the application's private IP address. Application network traffic can thus be forwarded to the application via any application connector that advertised the anycast address.

Examples of the present disclosure describe systems and methods for zero trust domain name system (DNS) (ZTDNS) based networking. A computing device implementing ZTDNS based networking blocks any outbound connections that are not included in a list of trusted IP addresses. The list of trusted IP addresses is updated in response to the computing device receiving from a trusted DNS server an IP address corresponding to a DNS request. In some examples, the ZTDNS based networking intercepts and evaluates outbound communications for applications that implement a custom application DNS client. In other examples, the ZTDNS based networking intercepts and evaluates outbound communications for virtual environments. The outbound communications for both the custom application DNS client and the virtual environments are proxied through a local DNS client of the computing device.

The invention provides an efficient multi-dimensional network penetration testing method based on RAG, which comprises the following steps: firstly, identifying sub-domain names possibly existing in a target website, and sequentially expanding attack surfaces of penetration testing to obtain vulnerability information pairs; secondly, a design model generated based on retrieval enhancement is adopted, vulnerability information pairs are extracted from the queue to be utilized, knowledge items related to local knowledge base retrieval and network intelligent search retrieval are utilized, and finally, a large model generates vulnerability utilization information according to the knowledge items; acquiring target machine permission for the previously acquired vulnerability information pair construction command injector, and further scanning other hosts of the intranet accessed by the target skipping machine; finally, combining vulnerability information obtained by penetration testing, utilizing a large model to sort vulnerabilities existing in different assets, and outputting penetration testing reports for different assets. According to the method and the system, comprehensive penetration testing of cross-network and cross-system is realized, security experts are helped to quickly identify, verify and repair vulnerabilities in a complex and changeable network environment, and high-efficiency and low-cost network security maintenance is realized.

The invention relates to a malicious website identification method and system based on IP address feature analysis, and belongs to the technical field of network security, and the method comprises the steps: collecting network flow data of an IP address through a network flow log, a firewall log and a DNS query record, and carrying out the preprocessing; constructing an IP dynamic graph structure by taking the IP addresses as nodes and the communication relationship between the IP addresses as edges according to the preprocessed network flow data; the IP dynamic graph structure is coded through a graph attention network, the complex relation between nodes is captured, the time sequence characteristics of IP address behaviors are captured in combination with a long and short-term memory network, and a behavior mode of the nodes is constructed; and calculating a reconstruction error and a local outlier factor LOF of the node according to a behavior pattern of the node, calculating an abnormal score of the IP address, and when the abnormal score is higher than a dynamic abnormal detection threshold, performing deep analysis by combining domain name characteristics, webpage content characteristics and network access behavior characteristics of the website, and identifying the malicious website.

The invention discloses a security verification method based on an ACME protocol, a security verification system based on the ACME protocol, a computer program product, a CA server, ACME client equipment and a computer readable storage medium. The method comprises the steps that a to-be-verified ACME client sends a certificate request to the CA server based on a target ACME account; if the CA server does not query an effective client authorization record of the to-be-verified ACME client based on the to-be-verified identification information, selecting at least one target domain name from the at least one verified domain name, and re-verifying the ownership of the to-be-verified ACME client to the at least one target domain name; and if the verification of the ownership is passed, the CA server generates an effective client authorization record for the to-be-verified ACME client based on the to-be-verified identification information, and issues a certificate for the to-be-verified ACME client based on the generated effective client authorization record and the effective domain name authorization record of the at least one verified domain name. The security of certificate issuing can be improved.

A method includes instructing a computing device of a user to determine when a webpage is loaded via a web browser; where the web browser includes at least one of: a plug-in or an extension associated with the provider server associated with a first entity; where the plug-in or the extension is configured to request and receive a unique schema-specific identifier from the provider server; instructing the computing device to determine that the webpage is a particular webpage based on a determination that the webpage includes at least one field to be populated with user information; determining that the particular webpage is associated with a look-alike domain name based on: comparing a domain name of the particular webpage with at least one domain name of at least one second entity associated with at least one previously used unique schema-specific identifier associated with the user or at least one other user.

The invention provides a webpage analysis code generation method, device and equipment based on a large language model, and relates to the technical field of natural language processing, webpage analysis and the like. The method comprises the following steps: determining a key information field according to a demand text of a webpage analysis task through a first large language model, and filling the key information field into a structured analysis prompt template to obtain an analysis prompt text; the key information field comprises at least one of the following items: a domain name of a target website, a target webpage type, a target webpage structure and a target data field; and through a second large language model, generating an analysis code of the webpage analysis task according to the analysis prompt text.

The invention provides a resource access method and device, a zero-trust platform and a storage medium, and the method comprises the steps: receiving an internal resource access request of a zero-trust client, the access request carrying an access address of a target resource, user information of the zero-trust client, and temporary authentication information; the access address comprises a zero-trust platform domain name and a target resource identifier, the zero-trust platform domain name points to a public network address of the zero-trust platform, and the target resource identifier is used for uniquely identifying a target resource; the temporary authentication information is used for authenticating that the zero-trust client has the qualification of initiating the access request; based on the user information and the temporary authentication information, verifying the user identity and the access authority of the zero-trust client; after the verification is successful, determining a real address of the target intranet server based on a pre-configured mapping relationship between the real address of the intranet server and the internal resource identifier; and forwarding the access request to the target intranet server according to the real address of the target intranet server.