[go: up one dir, main page]

CN102546683B - A kind of host computer domain name collecting method and device - Google Patents

A kind of host computer domain name collecting method and device Download PDF

Info

Publication number
CN102546683B
CN102546683B CN201010590403.8A CN201010590403A CN102546683B CN 102546683 B CN102546683 B CN 102546683B CN 201010590403 A CN201010590403 A CN 201010590403A CN 102546683 B CN102546683 B CN 102546683B
Authority
CN
China
Prior art keywords
web container
configuration file
domain
packet
container
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201010590403.8A
Other languages
Chinese (zh)
Other versions
CN102546683A (en
Inventor
陈奋
张永光
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Xiamen service cloud Mdt InfoTech Ltd
Original Assignee
Xiamen Meiya Pico Information Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Xiamen Meiya Pico Information Co Ltd filed Critical Xiamen Meiya Pico Information Co Ltd
Priority to CN201010590403.8A priority Critical patent/CN102546683B/en
Publication of CN102546683A publication Critical patent/CN102546683A/en
Application granted granted Critical
Publication of CN102546683B publication Critical patent/CN102546683B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Landscapes

  • Information Transfer Between Computers (AREA)

Abstract

The invention discloses a kind of host computer domain name collecting method, comprising: analyze the web Container Type that web server system is installed; The attribute of WEB container is calculated according to described WEB Container Type; According to the site information Profile Path of the attributes extraction WEB container of described WEB container; According to described Profile Path, extract configuration file; Resolution rules corresponding to its configuration file is extracted according to described WEB Container Type; The resolution rules corresponding according to described configuration file, analyzes described configuration file content, if be configured with domain-name information in configuration file, then extracts the domain-name information that configuration file comprises.

Description

A kind of host computer domain name collecting method and device
Technical field
The present invention relates to Internet technical field, particularly relate to a kind of host computer domain name collecting method and device.
Background technology
At present the domain name of (area, city, a province can be even countries) in certain limit is collected and management, mainly through two kinds of modes.First kind of way is collection and the management of policy formula, namely builds domain name docketing system and requires that domain name user carries out domain-name information filing and registration, reached collection and the management of domain-name information by the measure of some policys and the consciousness of domain name user.The second way is collection and the management of technical form, and main employing audits equipment in network egress increase at present, by initiatively extracting domain-name information to the analysis of network packet, thus reaches collection and the management of domain name.
All there are some problems in the method collected for above-mentioned two kinds of domain-name informations and manage: the method adopting domain name docketing system, by the intervention of policy, although the collection that can realize to a great extent domain-name information and management, but state (stop using, newly-increased etc. the state) change for domain-name information has no idea to carry out active monitoring, and therefore federation exists omission and the state uncertainty of some domain-name informations; Adopt the mode audited at network egress, although the effect of active discovery can be played to domain-name information, but also there is many problems: (1) data acquisition not in time or there is blind spot, if all nobody's access of certain domain name, would not be found; (2) just correct analysis cannot be carried out for the packet in encryption situation; (3) hardware drops into comparatively large, and cost is higher, disposes difficulty.
Summary of the invention
The invention discloses a kind of host computer domain name collecting method, comprising:
Analyze the web Container Type that web server system is installed;
The attribute of WEB container is calculated according to described WEB Container Type;
According to the site information Profile Path of the attributes extraction WEB container of described WEB container;
According to described Profile Path, extract configuration file;
Resolution rules corresponding to its configuration file is extracted according to described WEB Container Type;
The resolution rules corresponding according to described configuration file, analyzes described configuration file content, if be configured with domain-name information in configuration file, then extracts the domain-name information that configuration file comprises.
Preferably, install if described WEB container is the mode of serving, the site information Profile Path of the described attributes extraction WEB container according to described WEB container, is further:
According to the attribute of WEB container, the operating process list of traversal web server, finds the process title of described WEB container;
According to described process title seeking system service list, find the service that described WEB container is corresponding;
The installation directory of described WEB container is obtained according to the attribute of described service;
The site information Profile Path of described WEB container is obtained according to the installation directory of described WEB container.
Preferably, install if described WEB container is not the mode of serving, the site information Profile Path of the described attributes extraction WEB container according to described WEB container, is further:
According to the attribute of WEB container, the operating process list of traversal web server, finds the process title of described WEB container;
According to described process title, obtain the installation directory of described WEB container;
By described installation directory, obtain its Profile Path.
Preferably, if there is no domain-name information in described configuration file, then:
Judge that whether the data packet request of described web server is from external request;
If described data packet request is from external request, judge that whether the communication protocol of described packet is based on http protocol further;
If the communication protocol of described packet is based on http protocol, then obtain the website domain name in HTTP packet.
Preferably, describedly judge whether the data packet request of described web server is specially from external request: by judging the source IP information in the packet content of first in TCP three-way handshake packet, if source IP is not the IP of the machine, then can judge this request source external reference.
Preferably, if described data packet request is from external request, judge that whether the communication protocol of described packet is based on http protocol further, be specially: judge whether first packet content after a TCP connection three-way handshake packet comprises the feature of http protocol, if comprise these features, communication protocol is based on http protocol.
The invention also discloses a kind of host domain name gathering-device, comprise Website server configuration surroundings analysis module, network data packet analysis module and domain-name information memory module;
Domain name information storage module, is connected with described Website server configuration surroundings analysis module, network data packet analysis module, for storing the website domain-name information of extraction;
Described Website server configuration surroundings analysis module, for by analyzing Website server configuration surroundings, analyze the web Container Type that web server system is installed, calculate the attribute of WEB container according to WEB Container Type, thus extract the site information Profile Path of WEB container; And according to Profile Path, extract configuration file; Resolution rules corresponding to its configuration file is extracted according to the type of WEB container; The resolution rules corresponding according to configuration file, analysis configuration file content, if be configured with domain-name information in configuration file, then extracts the domain-name information that configuration file comprises;
Described network data packet analysis module, is connected with described Website server configuration surroundings analysis module, judges that whether data packet request is from external request; When data packet request is from external request, judge that whether the communication protocol of packet is based on http protocol further; When the communication protocol of packet is based on http protocol, obtain website domain-name information in HTTP packet.
The present invention obtains server domain name by analyzing and analyze server network bag the way combined to server web environment, guarantees the integrality of accessed domain name.
Accompanying drawing explanation
Fig. 1 is a kind of host computer domain name collecting method schematic diagram of the present invention.
Fig. 2 is the method schematic diagram being extracted domain-name information by network packet analysis of the present invention.
Fig. 3 is a kind of host domain name gathering-device structure chart
Embodiment
For Problems Existing, first embodiment of the invention discloses a kind of host computer domain name collecting method, as shown in Figure 1, mainly comprises the steps:
The web Container Type that step 1, analysis web server system are installed.
In this step, adopt the mode obtaining system service and Process Attributes, WEB container (referring to for running website and resolving the program of these website HTTP request) type that discovery system is installed, these types comprise IIS, apache, tomcat etc.;
Step 2, the WEB Container Type obtained by step 1 calculate the attribute of WEB container, according to the site information Profile Path of the attributes extraction WEB container of WEB container.
WEB container attribute can comprise following components:
● the title of process
● version number's service name (if installing with method of service)
● installation directory
In order to obtain the path of configuration file, we need to calculate with upper part attribute, thus obtain the installation directory of WEB container, the path (configuration file is generally arranged in certain particular path under installation directory) of configuration file can be obtained by installation directory.
Key step is as follows:
Install if WEB container is the mode of serving:
Step 201, travels through operating process list, finds the process title of WEB container;
Step 202, by process title seeking system service list, detects thus finds the service that WEB container is corresponding;
Step 203, obtains the installation directory of WEB container by Service Properties.The attribute of service comprises title, the application name of service, the installation directory of service of service.In this step, the attribute of service can be obtained by the title of service, also just can obtain the installation directory of program, and then obtain the site information Profile Path of WEB container.
If WEB container is not install with method of service, then use following steps:
Step 204, if WEB container is not install with method of service, obtains its installation directory by WEB container process information, and then the site information Profile Path of WEB container.The progress information of program carries out mapping by process title and obtains, and progress information mainly comprises installation directory, the version information of program, the resource utilization etc. of program of program.In this step, the progress information of program can be obtained by the title of program, so that the installation directory of program just can be obtained.
Step 205, by the installation directory of program, we can obtain its Profile Path.Configuration file is generally arranged in certain specific file under installation directory.
For Apache2.2,
First we search the operation process title httpd.exe that operating process list finds Apache2.2 container;
Then our traverse service list, find to exist the service that process name is called httpd.exe, and service name is Apache2;
Obtained the detailed attributes of its service by the service name of Apache, the installation path of Apache program can be obtained, and then obtain the path of its configuration file.
Step 3, according to Profile Path, extract configuration file; Resolution rules corresponding to its configuration file is extracted according to the type of WEB container;
Because the form of different WEB container configuration file is different, therefore in the file of a regulation, write configuration file resolution rules corresponding to known WEB Container Type in advance.When we know WEB Container Type, the resolution rules of its configuration file just can be extracted by the file of this regulation.Mainly comprise the steps:
Step 301, by the result of step 1 and step 2, we can obtain the type of WEB container and the path of configuration file;
Step 302, searches the resolution rules of its correspondence according to the type of WEB container.The resolution rules that more corresponding common WEB containers are corresponding is listed below shown in table:
Be more than known WEB container configuration file resolution rules, be stored in the file of a regulation.When there is a kind of new WEB container and resolution rules thereof, only needing the rule of correspondence to be write in the file of this regulation, this new WEB container configuration file can be adapted to and resolve.
Step 4, the resolution rules corresponding according to configuration file, analysis configuration file content, if be configured with domain-name information in configuration file, then extracts the domain-name information that configuration file comprises.
The resolution rules obtained by step 3 carrys out the content of analysis configuration file, thus can extract the domain-name information comprised in configuration file.
In this step, the domain name that domain-name information comprises movable domain name and stops using, distinguishes with a state value, can obtain the domain-name information of multiple WEB container simultaneously.The domain-name information obtained leaves internal memory in be breathed out in western container, and primary structure is as follows:
KEY (domain name) VELUE (state)
www.test1.com 0 (0 represents inactive)
www.test2.com 1 (1 expression activity)
Breathe out western container will be delivered in subsequent step, as the sharing space that information stores, search can carry out re-scheduling by KEY value simultaneously, avoid repeating data.
Step 5, when a WEB container only comprise a website or WEB container comprise multiple website and each website uses the situation of different port time, WEB container may not configure domain name in its configuration file.When not extracting domain-name information by step 4, extract other domain-name informations by network packet analysis.
The method of other domain-name informations is extracted by network packet analysis, grid is adopted to drive the analytic function of layer technology realization to network packet, network layer drives and realizes the monitor bypass of native network packet and only monitor Transmission Control Protocol (calcaneus rete station relevant http protocol on tcp protocol layer), thus the not normal packet flow process of influential system.Carried out the method for agreement real-time analysis by network packet, as shown in Figure 2, mainly comprise the steps:
Step 501, judges that whether data packet request is from external request.
In this step, doing this object judged is get to prevent the targeted website information that the machine carries out the non-native of HTTP access; By judging the source IP information in the packet content of first in TCP three-way handshake packet, if source IP is not the IP of the machine, then can judge this request source external reference.
Step 502, if data packet request is from external request, judges that whether the communication protocol of packet is based on http protocol.
In this step, by judge TCP connect three-way handshake packet after first packet content whether comprise the feature of http protocol, as information such as GET, POST, HTTP/1, if comprise these features, think http data.
Step 503, if the communication protocol of packet is based on http protocol, obtains website domain name part in HTTP packet.
Website domain name is arranged in http header HOST attribute section;
Step 504, compares the website domain name got and the domain name that obtains from the configuration file of WEB container, if there is not this domain name in WEB container, then domain name is saved in specific position (file or internal memory in).
Step 6, in the website domain-name information that aforesaid way analysis obtains and step 4, the internal memory that produces is breathed out western container contents and is compared, if do not exist in the western container in Kazakhstan, then website domain-name information is added to and breathe out (website that this step obtains is active state) in western container.
Mutually supplemented by the link obtaining website domain name and obtain domain name from web container from data packet analysis, the complete domain-name information list getting each WEB server in real time.
This patent proposes a kind of gathering-device and system of host domain name, gathering-device realizes in the mode of computer software, be arranged on above Website server main frame, by wanting that to the intellectual analysis of Website server web server configuration surroundings and the technology of auditing of network data Packet driven layer the mode combined realizes the dynamic collection to host domain name.Host domain name gathering system is made up of distributed gathering-device and receiving management center simultaneously: distributed host domain name gathering-device is responsible for collecting host domain name information in time, and receiving management center is responsible for the domain-name information collected to carry out inquiring about and managing stored in database.Achieved by patent of the present invention and the active of host domain name in certain limit is found and management, the domain name of not putting on record source can be provided for domain name management system of putting on record, and domain name docketing system is formed and well supplements; The simultaneously mode audited relative to network egress of the device that proposes of this patent and system, have dispose simple, with low cost, collect the data advantage such as timely comprehensively.
Second embodiment of the invention discloses a kind of host domain name gathering-device, as shown in Figure 3, mainly comprises Website server configuration surroundings analysis module, network data packet analysis module and domain-name information memory module.
Wherein, domain-name information memory module 3, is connected with described Website server configuration surroundings analysis module, network data packet analysis module, for storing the website domain-name information of extraction.
Website server configuration surroundings analysis module 1, for by analyzing Website server configuration surroundings, analyze the web Container Type that web server system is installed, calculate the attribute of WEB container according to WEB Container Type, thus extract the site information Profile Path of WEB container; And according to Profile Path, extract configuration file; Resolution rules corresponding to its configuration file is extracted according to the type of WEB container; The resolution rules corresponding according to configuration file, analysis configuration file content, if be configured with domain-name information in configuration file, then extracts the domain-name information that configuration file comprises.
Network data packet analysis module 2, is connected with described Website server configuration surroundings analysis module, judges that whether data packet request is from external request; If data packet request is from external request, judge that whether the communication protocol of packet is based on http protocol; If the communication protocol of packet is based on http protocol, obtain website domain name part in HTTP packet; And the domain name obtained from the configuration file of WEB container in the website domain name got and domain-name information memory module 3 is compared, if there is no this domain name, be then saved in this domain name in domain-name information memory module 3.
This device obtains server domain name by analyzing and analyze server network bag the way combined to server web environment, guarantees the integrality of accessed domain name.
Above-described embodiment is only used for further illustrating method of the present invention and device thereof; but the present invention is not limited to embodiment; every above embodiment is done according to technical spirit of the present invention any simple modification, equivalent variations and modification, all fall into the protection range of technical solution of the present invention.

Claims (5)

1. a host computer domain name collecting method, is characterized in that, comprising:
Analyze the WEB Container Type that web server system is installed;
The attribute of WEB container is calculated according to described WEB Container Type;
According to the site information Profile Path of the attributes extraction WEB container of described WEB container;
According to described Profile Path, extract configuration file;
Resolution rules corresponding to its configuration file is extracted according to described WEB Container Type;
The resolution rules corresponding according to described configuration file, analyzes described configuration file content, if be configured with domain-name information in configuration file, then extracts the domain-name information that configuration file comprises;
Install if described WEB container is the mode of serving, the site information Profile Path of the described attributes extraction WEB container according to described WEB container, is further:
According to the attribute of WEB container, the operating process list of traversal WEB server, finds the process title of described WEB container;
According to described process title seeking system service list, find the service that described WEB container is corresponding;
The installation directory of described WEB container is obtained according to the attribute of described service;
The site information Profile Path of described WEB container is obtained according to the installation directory of described WEB container;
Install if described WEB container is not the mode of serving, the site information Profile Path of the described attributes extraction WEB container according to described WEB container, is further:
According to the attribute of WEB container, the operating process list of traversal WEB server, finds the process title of described WEB container;
According to described process title, obtain the installation directory of described WEB container;
By described installation directory, obtain its Profile Path.
2. method according to claim 1, is characterized in that, if there is no domain-name information in described configuration file, then:
Judge that whether the data packet request of described WEB server is from external request;
If described data packet request is from external request, judge that whether the communication protocol of described packet is based on http protocol further;
If the communication protocol of described packet is based on http protocol, then obtain the website domain name in HTTP packet.
3. method according to claim 2, is characterized in that, describedly judges whether the data packet request of described WEB server is specially from external request:
By judging the source IP information in the packet content of first in TCP three-way handshake packet, if source IP is not the IP of the machine, then can judge this request source external reference.
4. method according to claim 2, it is characterized in that, if described data packet request is from external request, judge that whether the communication protocol of described packet is based on http protocol further, be specially: judge whether first packet content after a TCP connection three-way handshake packet comprises the feature of http protocol, if comprise these features, communication protocol is based on http protocol.
5. a host domain name gathering-device, is characterized in that, comprises Website server configuration surroundings analysis module, network data packet analysis module and domain-name information memory module;
Domain name information storage module, is connected with described Website server configuration surroundings analysis module, network data packet analysis module, for storing the website domain-name information of extraction;
Described Website server configuration surroundings analysis module, for by analyzing Website server configuration surroundings, analyze the WEB Container Type that web server system is installed, calculate the attribute of WEB container according to WEB Container Type, thus extract the site information Profile Path of WEB container; And according to Profile Path, extract configuration file; Resolution rules corresponding to its configuration file is extracted according to the type of WEB container; The resolution rules corresponding according to configuration file, analysis configuration file content, if be configured with domain-name information in configuration file, then extracts the domain-name information that configuration file comprises;
Install if described WEB container is the mode of serving, the site information Profile Path of described extraction WEB container is: according to the attribute of WEB container that the operating process list of traversal WEB server, finds the process title of described WEB container further; According to described process title seeking system service list, find the service that described WEB container is corresponding; The installation directory of described WEB container is obtained according to the attribute of described service; The site information Profile Path of described WEB container is obtained according to the installation directory of described WEB container;
Install if described WEB container is not the mode of serving, the site information Profile Path of described extraction WEB container is: according to the attribute of WEB container that the operating process list of traversal WEB server, finds the process title of described WEB container further; According to described process title, obtain the installation directory of described WEB container; By described installation directory, obtain its Profile Path;
Described network data packet analysis module, is connected with described Website server configuration surroundings analysis module, judges that whether data packet request is from external request; When data packet request is from external request, judge that whether the communication protocol of packet is based on http protocol further; When the communication protocol of packet is based on http protocol, obtain website domain-name information in HTTP packet.
CN201010590403.8A 2010-12-10 2010-12-10 A kind of host computer domain name collecting method and device Active CN102546683B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201010590403.8A CN102546683B (en) 2010-12-10 2010-12-10 A kind of host computer domain name collecting method and device

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201010590403.8A CN102546683B (en) 2010-12-10 2010-12-10 A kind of host computer domain name collecting method and device

Publications (2)

Publication Number Publication Date
CN102546683A CN102546683A (en) 2012-07-04
CN102546683B true CN102546683B (en) 2015-09-02

Family

ID=46352640

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201010590403.8A Active CN102546683B (en) 2010-12-10 2010-12-10 A kind of host computer domain name collecting method and device

Country Status (1)

Country Link
CN (1) CN102546683B (en)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106453492B (en) * 2016-08-30 2019-05-14 浙江大学 Container dispatching method under Docker container cloud platform based on Fuzzy Pattern Recognition
CN106330981B (en) * 2016-11-09 2020-06-19 国网浙江省电力公司电力科学研究院 A kind of network website information collection method and device
CN110213310B (en) * 2018-03-14 2021-11-30 腾讯科技(深圳)有限公司 Method, device and storage medium for acquiring path of network service
CN109905396A (en) * 2019-03-11 2019-06-18 北京奇艺世纪科技有限公司 A kind of WebShell file test method, device and electronic equipment

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1794725A (en) * 2005-12-29 2006-06-28 华中师范大学 Embedded type mobile web server
CN1987773A (en) * 2005-12-20 2007-06-27 北京大学 Integrated framework for web container in J2EE application server
CN101217576A (en) * 2008-01-18 2008-07-09 厦门纳网科技有限公司 A dynamic domain name analysis system and the corresponding dynamic analysis method

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8966121B2 (en) * 2008-03-03 2015-02-24 Microsoft Corporation Client-side management of domain name information

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1987773A (en) * 2005-12-20 2007-06-27 北京大学 Integrated framework for web container in J2EE application server
CN1794725A (en) * 2005-12-29 2006-06-28 华中师范大学 Embedded type mobile web server
CN101217576A (en) * 2008-01-18 2008-07-09 厦门纳网科技有限公司 A dynamic domain name analysis system and the corresponding dynamic analysis method

Also Published As

Publication number Publication date
CN102546683A (en) 2012-07-04

Similar Documents

Publication Publication Date Title
Perdisci et al. Iotfinder: Efficient large-scale identification of iot devices via passive dns traffic analysis
CN102724059B (en) Website operation state monitoring and abnormal detection based on MapReduce
CN106656577B (en) The user behavior statistical method and intelligent router of a kind of APP and browser
CN104144142B (en) A kind of Web bug excavation methods and system
CN102685224B (en) User behavior analysis method, related equipment and system
CN107465651A (en) Network attack detecting method and device
CN102546683B (en) A kind of host computer domain name collecting method and device
CN101924757A (en) Method and system for reviewing Botnet
CN102055813A (en) Access controlling method for network application and device thereof
CN104391979A (en) Malicious web crawler recognition method and device
US11616848B2 (en) Curating proxy server pools
CN103888305A (en) Home gateway-based monitoring method and system
CN103067198A (en) Method and system related to Cookie identity (ID) of user
KR20120087393A (en) Method for real-time detecting anomalies using dns packet
CN110020161B (en) Data processing method, log processing method and terminal
CN105989149A (en) Method and system for extracting and recognizing fingerprint of user equipment
CN106021552A (en) Internet creeper concurrency data collection method and system based on crowd behavior simulation
CN102984003A (en) Network access detection system and network access detection method
CN105159992A (en) Method and device for detecting page contents and network behaviors of application program
CN102256297A (en) TD-SCDMA (Time Division-Synchronization Code Division Multiple Access) wireless communication network service user perception data collection method
US20120147179A1 (en) Method and system for providing intelligent access monitoring, intelligent access monitoring apparatus
CN115437874A (en) Information security risk analysis and monitoring system based on network assets
CN108270637A (en) A kind of Website quality multilayer drills through system and method
CN105471676A (en) Port scanning IP address activity degree statistical system and method
CN103595692A (en) A method and a system which both analyze user network behaviors through household gateways

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
C14 Grant of patent or utility model
GR01 Patent grant
EE01 Entry into force of recordation of patent licensing contract

Application publication date: 20120704

Assignee: Xiamen service cloud Mdt InfoTech Ltd

Assignor: Xiamen Meiya Pico Information Co., Ltd.

Contract record no.: 2016350000003

Denomination of invention: Host computer domain name collecting method and device

Granted publication date: 20150902

License type: Exclusive License

Record date: 20160120

LICC Enforcement, change and cancellation of record of contracts on the licence for exploitation of a patent or utility model
C41 Transfer of patent application or patent right or utility model
TR01 Transfer of patent right

Effective date of registration: 20160520

Address after: 361000 Fujian province Xiamen software park two sunrise Road No. 12 unit 403

Patentee after: Xiamen service cloud Mdt InfoTech Ltd

Address before: 361008 Fujian province Xiamen software park two sunrise Road No. 12 102-402

Patentee before: Xiamen Meiya Pico Information Co., Ltd.