Summary of the invention
The invention discloses a kind of host computer domain name collecting method, comprising:
Analyze the web Container Type that web server system is installed;
The attribute of WEB container is calculated according to described WEB Container Type;
According to the site information Profile Path of the attributes extraction WEB container of described WEB container;
According to described Profile Path, extract configuration file;
Resolution rules corresponding to its configuration file is extracted according to described WEB Container Type;
The resolution rules corresponding according to described configuration file, analyzes described configuration file content, if be configured with domain-name information in configuration file, then extracts the domain-name information that configuration file comprises.
Preferably, install if described WEB container is the mode of serving, the site information Profile Path of the described attributes extraction WEB container according to described WEB container, is further:
According to the attribute of WEB container, the operating process list of traversal web server, finds the process title of described WEB container;
According to described process title seeking system service list, find the service that described WEB container is corresponding;
The installation directory of described WEB container is obtained according to the attribute of described service;
The site information Profile Path of described WEB container is obtained according to the installation directory of described WEB container.
Preferably, install if described WEB container is not the mode of serving, the site information Profile Path of the described attributes extraction WEB container according to described WEB container, is further:
According to the attribute of WEB container, the operating process list of traversal web server, finds the process title of described WEB container;
According to described process title, obtain the installation directory of described WEB container;
By described installation directory, obtain its Profile Path.
Preferably, if there is no domain-name information in described configuration file, then:
Judge that whether the data packet request of described web server is from external request;
If described data packet request is from external request, judge that whether the communication protocol of described packet is based on http protocol further;
If the communication protocol of described packet is based on http protocol, then obtain the website domain name in HTTP packet.
Preferably, describedly judge whether the data packet request of described web server is specially from external request: by judging the source IP information in the packet content of first in TCP three-way handshake packet, if source IP is not the IP of the machine, then can judge this request source external reference.
Preferably, if described data packet request is from external request, judge that whether the communication protocol of described packet is based on http protocol further, be specially: judge whether first packet content after a TCP connection three-way handshake packet comprises the feature of http protocol, if comprise these features, communication protocol is based on http protocol.
The invention also discloses a kind of host domain name gathering-device, comprise Website server configuration surroundings analysis module, network data packet analysis module and domain-name information memory module;
Domain name information storage module, is connected with described Website server configuration surroundings analysis module, network data packet analysis module, for storing the website domain-name information of extraction;
Described Website server configuration surroundings analysis module, for by analyzing Website server configuration surroundings, analyze the web Container Type that web server system is installed, calculate the attribute of WEB container according to WEB Container Type, thus extract the site information Profile Path of WEB container; And according to Profile Path, extract configuration file; Resolution rules corresponding to its configuration file is extracted according to the type of WEB container; The resolution rules corresponding according to configuration file, analysis configuration file content, if be configured with domain-name information in configuration file, then extracts the domain-name information that configuration file comprises;
Described network data packet analysis module, is connected with described Website server configuration surroundings analysis module, judges that whether data packet request is from external request; When data packet request is from external request, judge that whether the communication protocol of packet is based on http protocol further; When the communication protocol of packet is based on http protocol, obtain website domain-name information in HTTP packet.
The present invention obtains server domain name by analyzing and analyze server network bag the way combined to server web environment, guarantees the integrality of accessed domain name.
Embodiment
For Problems Existing, first embodiment of the invention discloses a kind of host computer domain name collecting method, as shown in Figure 1, mainly comprises the steps:
The web Container Type that step 1, analysis web server system are installed.
In this step, adopt the mode obtaining system service and Process Attributes, WEB container (referring to for running website and resolving the program of these website HTTP request) type that discovery system is installed, these types comprise IIS, apache, tomcat etc.;
Step 2, the WEB Container Type obtained by step 1 calculate the attribute of WEB container, according to the site information Profile Path of the attributes extraction WEB container of WEB container.
WEB container attribute can comprise following components:
● the title of process
● version number's service name (if installing with method of service)
● installation directory
In order to obtain the path of configuration file, we need to calculate with upper part attribute, thus obtain the installation directory of WEB container, the path (configuration file is generally arranged in certain particular path under installation directory) of configuration file can be obtained by installation directory.
Key step is as follows:
Install if WEB container is the mode of serving:
Step 201, travels through operating process list, finds the process title of WEB container;
Step 202, by process title seeking system service list, detects thus finds the service that WEB container is corresponding;
Step 203, obtains the installation directory of WEB container by Service Properties.The attribute of service comprises title, the application name of service, the installation directory of service of service.In this step, the attribute of service can be obtained by the title of service, also just can obtain the installation directory of program, and then obtain the site information Profile Path of WEB container.
If WEB container is not install with method of service, then use following steps:
Step 204, if WEB container is not install with method of service, obtains its installation directory by WEB container process information, and then the site information Profile Path of WEB container.The progress information of program carries out mapping by process title and obtains, and progress information mainly comprises installation directory, the version information of program, the resource utilization etc. of program of program.In this step, the progress information of program can be obtained by the title of program, so that the installation directory of program just can be obtained.
Step 205, by the installation directory of program, we can obtain its Profile Path.Configuration file is generally arranged in certain specific file under installation directory.
For Apache2.2,
First we search the operation process title httpd.exe that operating process list finds Apache2.2 container;
Then our traverse service list, find to exist the service that process name is called httpd.exe, and service name is Apache2;
Obtained the detailed attributes of its service by the service name of Apache, the installation path of Apache program can be obtained, and then obtain the path of its configuration file.
Step 3, according to Profile Path, extract configuration file; Resolution rules corresponding to its configuration file is extracted according to the type of WEB container;
Because the form of different WEB container configuration file is different, therefore in the file of a regulation, write configuration file resolution rules corresponding to known WEB Container Type in advance.When we know WEB Container Type, the resolution rules of its configuration file just can be extracted by the file of this regulation.Mainly comprise the steps:
Step 301, by the result of step 1 and step 2, we can obtain the type of WEB container and the path of configuration file;
Step 302, searches the resolution rules of its correspondence according to the type of WEB container.The resolution rules that more corresponding common WEB containers are corresponding is listed below shown in table:
Be more than known WEB container configuration file resolution rules, be stored in the file of a regulation.When there is a kind of new WEB container and resolution rules thereof, only needing the rule of correspondence to be write in the file of this regulation, this new WEB container configuration file can be adapted to and resolve.
Step 4, the resolution rules corresponding according to configuration file, analysis configuration file content, if be configured with domain-name information in configuration file, then extracts the domain-name information that configuration file comprises.
The resolution rules obtained by step 3 carrys out the content of analysis configuration file, thus can extract the domain-name information comprised in configuration file.
In this step, the domain name that domain-name information comprises movable domain name and stops using, distinguishes with a state value, can obtain the domain-name information of multiple WEB container simultaneously.The domain-name information obtained leaves internal memory in be breathed out in western container, and primary structure is as follows:
KEY (domain name) |
VELUE (state) |
www.test1.com |
0 (0 represents inactive) |
www.test2.com |
1 (1 expression activity) |
Breathe out western container will be delivered in subsequent step, as the sharing space that information stores, search can carry out re-scheduling by KEY value simultaneously, avoid repeating data.
Step 5, when a WEB container only comprise a website or WEB container comprise multiple website and each website uses the situation of different port time, WEB container may not configure domain name in its configuration file.When not extracting domain-name information by step 4, extract other domain-name informations by network packet analysis.
The method of other domain-name informations is extracted by network packet analysis, grid is adopted to drive the analytic function of layer technology realization to network packet, network layer drives and realizes the monitor bypass of native network packet and only monitor Transmission Control Protocol (calcaneus rete station relevant http protocol on tcp protocol layer), thus the not normal packet flow process of influential system.Carried out the method for agreement real-time analysis by network packet, as shown in Figure 2, mainly comprise the steps:
Step 501, judges that whether data packet request is from external request.
In this step, doing this object judged is get to prevent the targeted website information that the machine carries out the non-native of HTTP access; By judging the source IP information in the packet content of first in TCP three-way handshake packet, if source IP is not the IP of the machine, then can judge this request source external reference.
Step 502, if data packet request is from external request, judges that whether the communication protocol of packet is based on http protocol.
In this step, by judge TCP connect three-way handshake packet after first packet content whether comprise the feature of http protocol, as information such as GET, POST, HTTP/1, if comprise these features, think http data.
Step 503, if the communication protocol of packet is based on http protocol, obtains website domain name part in HTTP packet.
Website domain name is arranged in http header HOST attribute section;
Step 504, compares the website domain name got and the domain name that obtains from the configuration file of WEB container, if there is not this domain name in WEB container, then domain name is saved in specific position (file or internal memory in).
Step 6, in the website domain-name information that aforesaid way analysis obtains and step 4, the internal memory that produces is breathed out western container contents and is compared, if do not exist in the western container in Kazakhstan, then website domain-name information is added to and breathe out (website that this step obtains is active state) in western container.
Mutually supplemented by the link obtaining website domain name and obtain domain name from web container from data packet analysis, the complete domain-name information list getting each WEB server in real time.
This patent proposes a kind of gathering-device and system of host domain name, gathering-device realizes in the mode of computer software, be arranged on above Website server main frame, by wanting that to the intellectual analysis of Website server web server configuration surroundings and the technology of auditing of network data Packet driven layer the mode combined realizes the dynamic collection to host domain name.Host domain name gathering system is made up of distributed gathering-device and receiving management center simultaneously: distributed host domain name gathering-device is responsible for collecting host domain name information in time, and receiving management center is responsible for the domain-name information collected to carry out inquiring about and managing stored in database.Achieved by patent of the present invention and the active of host domain name in certain limit is found and management, the domain name of not putting on record source can be provided for domain name management system of putting on record, and domain name docketing system is formed and well supplements; The simultaneously mode audited relative to network egress of the device that proposes of this patent and system, have dispose simple, with low cost, collect the data advantage such as timely comprehensively.
Second embodiment of the invention discloses a kind of host domain name gathering-device, as shown in Figure 3, mainly comprises Website server configuration surroundings analysis module, network data packet analysis module and domain-name information memory module.
Wherein, domain-name information memory module 3, is connected with described Website server configuration surroundings analysis module, network data packet analysis module, for storing the website domain-name information of extraction.
Website server configuration surroundings analysis module 1, for by analyzing Website server configuration surroundings, analyze the web Container Type that web server system is installed, calculate the attribute of WEB container according to WEB Container Type, thus extract the site information Profile Path of WEB container; And according to Profile Path, extract configuration file; Resolution rules corresponding to its configuration file is extracted according to the type of WEB container; The resolution rules corresponding according to configuration file, analysis configuration file content, if be configured with domain-name information in configuration file, then extracts the domain-name information that configuration file comprises.
Network data packet analysis module 2, is connected with described Website server configuration surroundings analysis module, judges that whether data packet request is from external request; If data packet request is from external request, judge that whether the communication protocol of packet is based on http protocol; If the communication protocol of packet is based on http protocol, obtain website domain name part in HTTP packet; And the domain name obtained from the configuration file of WEB container in the website domain name got and domain-name information memory module 3 is compared, if there is no this domain name, be then saved in this domain name in domain-name information memory module 3.
This device obtains server domain name by analyzing and analyze server network bag the way combined to server web environment, guarantees the integrality of accessed domain name.
Above-described embodiment is only used for further illustrating method of the present invention and device thereof; but the present invention is not limited to embodiment; every above embodiment is done according to technical spirit of the present invention any simple modification, equivalent variations and modification, all fall into the protection range of technical solution of the present invention.