The invention discloses
a domain name parser cache mode recognition method based on
time sequence consistency analysis, and belongs to the technical field of
internet security monitoring. The method comprises the following steps: continuously sending
domain name query commands for the same
domain name to a target
repeater for multiple times, and obtaining message data, the message data comprises an
IP address of an upstream
recursion resolver used for data collection in a message returned by the
domain name server in response to each domain name query command, time when the domain
name server receives the domain name query command and a TTL value of a resource
record in
a domain name query response; the
detector continuously sends version query commands for obtaining the
software version of the same domain
name server to the target
transponder for multiple times, query data is obtained, and the query data comprises version information in messages returned by the domain
name server in response to the version query commands; and determining that the cache mode of the target
transponder is a transparent mode based on the message data and the query data. According to the method, the caching behavior of the DNS
transponder is accurately identified.