CN115277636B - A generic domain name resolution method and system - Google Patents

Abstract

The embodiment of the application discloses a method and a system for resolving a generic domain name, which are applied to the technical field of computers. The method comprises the following steps: acquiring a sub domain name list and sub domain name information of each sub domain name; traversing all the sub-domain names, and judging whether the sub-domain names with the same resolution record exist in the sub-domain name list according to the resolution record of the sub-domain name to be traversed; if so, judging whether the sub domain names with the same survival time value exist in the sub domain name list according to the survival time value of the sub domain name to be traversed; if yes, determining whether the response similarity condition is met according to the response similarity of the sub-domain name to be traversed in the sub-domain name list, and if yes, adding the sub-domain name to be traversed into a non-generalized resolution list; and outputting a non-generic resolution list until all the sub-domain names in the sub-domain name list are processed. Whether a domain name is resolved through flooding can be determined efficiently and concisely.

Description

A generic domain name resolution method and system

technical field

The embodiment of the present application relates to the field of computer technology, and in particular to a generic domain name resolution method and system.

Background technique

Decision tree is a supervised learning algorithm based on if-then-else rules. Through the training of these rules of decision tree, it can process irrelevant features and process different types of data at the same time, so as to obtain more standard data. Responsive similarity comparison is to obtain the similarity between the two pages by comparing the phrases, characters, HTML structure and style of the two pages.

The prior art simply determines whether the domain name is pan-analyzed through enumeration, which is too inefficient and cannot enumerate all subdomain names. There is also a method of saving the IP as a blacklist by recording the pan-analysis, and there will be a large number of false positives. For example, if an existing domain name is resolved to an IP that has been marked as blacklisted, it will cause false positives.

Contents of the invention

To this end, the embodiments of the present application provide a generic domain name resolution method and system, which efficiently and concisely determine whether a domain name is obtained through generic resolution.

In order to achieve the above purpose, the embodiment of the present application provides the following technical solutions:

According to the first aspect of the embodiments of the present application, a generic domain name resolution method is provided, the method comprising:

Obtain a list of subdomain names and subdomain information of each subdomain name; the subdomain information includes resolution records and survival time values;

Traversing all sub-domain names, judging whether there is a sub-domain name with the same resolution record in the sub-domain name list according to the resolution records of the sub-domain names to be traversed; if not, adding the sub-domain names to be traversed to the non-panic resolution list;

If there is, then judge whether there is a subdomain name with the same lifetime value in the subdomain name list according to the survival time value of the subdomain name to be traversed; if not, then add the subdomain name to be traversed to the non-pan resolution list ;

If so, determine whether the response similarity condition is met according to the response similarity of the subdomain name to be traversed in the subdomain name list, and if so, add the subdomain name to be traversed to the non-pan resolution list;

After all the subdomain names in the subdomain name list are processed, the non-panic resolution list is output.

Optionally, according to the response similarity of the subdomain name to be traversed in the subdomain name list, it is determined whether the response similarity condition is met, and if so, adding the subdomain name to be traversed to the non-pan resolution list ,include:

Carry out similarity calculation for each subdomain name in the non-pan resolution list, and determine the similarity between each sub domain name and the remaining sub domain names in the non-pan resolution list;

Adding the sub-domain names in the non-panic resolution list whose similarity is lower than the set threshold to the final non-panic resolution list and outputting it.

Optionally, before the acquisition of the subdomain name list and the subdomain name information of each subdomain name, the method includes:

Get the root domain name of the subdomain name;

According to the root domain name, it is judged whether there is a pan-analysis behavior. If it exists, the next step is to obtain the sub-domain name list and the sub-domain name information of each sub-domain name; if it does not exist, the screening of the root domain name is ended.

Optionally, the resolution record of the subdomain name includes the subdomain name and the corresponding root domain name, subdomain resolution data and resolution times, the first resolution time and the last resolution time of the subdomain name.

According to the second aspect of the embodiment of the present application, a generic domain name resolution system is provided, the system includes:

An information acquisition module, configured to acquire a list of subdomain names and subdomain information of each subdomain name; the subdomain information includes resolution records and time-to-live values;

The first judging module is used for traversing all sub-domain names, and judging whether there is a sub-domain name with the same resolution record in the sub-domain name list according to the resolution records of the sub-domain names to be traversed; if not, adding the sub-domain names to be traversed Non-pan parsed list;

The second judging module is used to judge whether there is a sub-domain name with the same survival time value in the sub-domain name list according to the survival time value of the sub-domain name to be traversed; if not, then the sub-domain name to be traversed Add the non-pan analysis list;

The third judging module is used to determine whether the response similarity condition is met according to the response similarity of the subdomain name to be traversed in the subdomain name list, if yes, to add the subdomain name to be traversed to all Describe the non-pan analysis list;

The output module is configured to output the non-panic resolution list until all the subdomain names in the subdomain name list are processed.

Optionally, the third judging module is specifically used for:

Carry out similarity calculation for each subdomain name in the non-pan resolution list, and determine the similarity between each sub domain name and the remaining sub domain names in the non-pan resolution list;

Adding the sub-domain names in the non-panic resolution list whose similarity is lower than the set threshold to the final non-panic resolution list and outputting it.

Optionally, the system also includes:

The information obtaining module is also used to obtain the root domain name of the subdomain name;

According to the root domain name, it is judged whether there is a pan-analysis behavior. If it exists, the next step is to obtain the sub-domain name list and the sub-domain name information of each sub-domain name; if it does not exist, the screening of the root domain name is ended.

Optionally, the resolution record of the subdomain name includes the subdomain name and the corresponding root domain name, subdomain resolution data and resolution times, the first resolution time and the last resolution time of the subdomain name.

According to a third aspect of the embodiments of the present application, there is provided an electronic device, including: a memory, a processor, and a computer program stored in the memory and operable on the processor, and the processor runs the The computer program is executed to implement the method described in the first aspect above.

According to a fourth aspect of the embodiments of the present application, there is provided a computer-readable storage medium, on which computer-readable instructions are stored, and the computer-readable instructions can be executed by a processor to implement the method described in the above-mentioned first aspect .

To sum up, the embodiment of the present application provides a pan-domain name resolution method and system, by obtaining the sub-domain name list and the sub-domain name information of each sub-domain name; the sub-domain name information includes resolution records and lifetime values; traversing all sub-domain domain name, judge whether there is a subdomain name with the same resolution record in the subdomain name list according to the resolution record of the subdomain name to be traversed; if not, add the subdomain name to be traversed to the non-panic resolution list; The survival time value of the subdomain name to be traversed determines whether there is a subdomain name with the same survival time value in the subdomain name list; if not, then the subdomain name to be traversed is added to the non-pan resolution list; Determine whether the response similarity of the traversed sub-domain name in the sub-domain name list meets the response similarity condition, if so, add the sub-domain name to be traversed to the non-pan resolution list; until all the sub-domain names in the sub-domain name list After the subdomain names are all processed, the non-pan resolution list will be output. Efficiently and concisely determine whether a domain name is obtained through universal analysis.

Description of drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following will briefly introduce the accompanying drawings that are required in the description of the embodiments or the prior art. Apparently, the drawings in the following description are only exemplary, and those skilled in the art can also obtain other implementation drawings according to the provided drawings without creative work.

The structures, proportions, sizes, etc. shown in this manual are only used to cooperate with the content disclosed in the manual, so that people familiar with this technology can understand and read, and are not used to limit the conditions for the implementation of the present invention, so there is no technical In the substantive meaning above, any modification of structure, change of proportional relationship or adjustment of size should still fall within the scope of the technical contents disclosed in the present invention without affecting the effects and goals that can be achieved by the present invention. within the scope covered.

Fig. 1 is a schematic flow chart of a generic domain name resolution method provided by the embodiment of the present application;

Fig. 2 is the flow chart of pan-domain name analysis provided by the embodiment of the present application;

FIG. 3 is a block diagram of a generic domain name resolution system provided by an embodiment of the present application;

FIG. 4 shows a schematic structural diagram of an electronic device provided by an embodiment of the present application;

Fig. 5 shows a schematic diagram of a computer-readable storage medium provided by an embodiment of the present application.

Detailed ways

The implementation mode of the present invention is illustrated by specific specific examples below, and those who are familiar with this technology can easily understand other advantages and effects of the present invention from the contents disclosed in this description. Obviously, the described embodiments are a part of the present invention. , but not all examples. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

Fig. 1 shows the generic domain name resolution method provided by the embodiment of the present application, the method includes:

Step S101: Obtain the subdomain name list and the subdomain name information of each subdomain name; the subdomain name information includes resolution records and survival time values;

Step S102: traverse all subdomain names, judge whether there is a subdomain name with the same resolution record in the subdomain name list according to the resolution record of the subdomain name to be traversed; if not, add the subdomain name to be traversed into the non-panic resolution list ;

Step S103: If there is, judge whether there is a subdomain name with the same lifetime value in the subdomain name list according to the lifetime value of the subdomain name to be traversed; if not, add the subdomain name to be traversed to the non- Pan analysis list;

Step S104: If yes, determine whether the response similarity condition of the subdomain name to be traversed in the subdomain name list meets the response similarity condition, and if so, add the subdomain name to be traversed to the non-panic analysis list;

Step S105: until all subdomain names in the subdomain name list are processed, output the non-panic resolution list.

In a possible implementation, in step S104, according to the response similarity of the subdomain name to be traversed in the subdomain name list, it is determined whether the response similarity condition is met, and if so, the to-be-traversed Add the non-pan resolution list of subdomain names, including:

Carry out similarity calculation for each sub-domain name in the non-pan resolution list, determine the similarity between each sub-domain name and the remaining sub-domain names in the non-pan resolution list; Add the subdomain names with a certain threshold to the final non-pan resolution list and output it.

In a possible implementation manner, before obtaining the subdomain name list and the subdomain name information of each subdomain name in step S101, the method includes:

Obtain the root domain name of the sub-domain name; judge whether there is a pan-analysis behavior according to the root domain name, if it exists, proceed to the next step to obtain the sub-domain name list and the sub-domain name information of each sub-domain name; if not, end the root domain name filter.

In a possible implementation manner, the resolution record of the subdomain name includes the subdomain name and the corresponding root domain name, subdomain resolution data and resolution times, the first resolution time and the last resolution time of the subdomain name.

FIG. 2 shows a schematic diagram of an embodiment of a generic domain name resolution method provided by the embodiment of the present application. The method includes the following steps:

Step 1: Obtain a list of subdomain names and subdomain information of each subdomain name; the subdomain information includes resolution records and survival time values;

Step 2: Start traversing each sub-domain name; for each sub-domain name, first judge whether there is a sub-domain name with the same resolution record in the sub-domain name list according to the resolution record of the sub-domain name to be traversed, if not, mark it as non-pan resolution Record; if the same, go to step 3;

Step 3: Determine whether there is a subdomain name with the same lifetime value in the subdomain name list according to the TTL value of the subdomain name to be traversed, if not, mark it as a non-pan resolution record, if the same, go to step 4;

Step 4: Store all the non-pan analysis records obtained in step 3 in a list;

Step 5: Through response similarity comparison, compare all the data in the list, determine whether the response similarity condition is met according to the response similarity of the subdomain name to be traversed in the subdomain name list, and make all similarities less than 100% Eighty data are marked as non-pan analysis records;

Step 6: Count all the data marked as non-pan-parsed records, and output a document.

To sum up, the embodiment of the present application provides a pan-domain name resolution method, by obtaining the sub-domain name list and the sub-domain name information of each sub-domain name; traversing all sub-domain names, and judging the sub-domain name according to the resolution record of the sub-domain name to be traversed Whether there is a subdomain name with the same resolution record in the list; if so, judge whether there is a subdomain name with the same survival time value in the subdomain name list according to the survival time value of the subdomain name to be traversed; Determine whether the response similarity of the subdomain name in the subdomain name list meets the response similarity condition, and if so, add the subdomain name to be traversed to the non-pan resolution list; until all subdomain names in the subdomain name list After all are processed, the non-pan-parsed list is output. Efficiently and concisely determine whether a domain name is obtained through universal analysis.

Based on the same technical idea, the embodiment of the present application also provides a generic domain name resolution system, as shown in Figure 3, the system includes:

An information acquisition module 301, configured to acquire a subdomain name list and subdomain information of each subdomain name; the subdomain information includes resolution records and survival time values;

The first judging module 302 is used to traverse all sub-domain names, and judge whether there is a sub-domain name with the same resolution record in the sub-domain name list according to the resolution records of the sub-domain names to be traversed; Add non-pan analysis list;

The second judging module 303 is used to judge whether there is a sub-domain name with the same survival time value in the sub-domain name list according to the survival time value of the sub-domain name to be traversed; The domain name is added to the non-pan resolution list;

The third judging module 304 is used to determine whether the response similarity condition is met according to the response similarity of the subdomain name to be traversed in the subdomain name list, if yes, to add the subdomain name to be traversed to The non-pan parse list;

The output module 305 is configured to output the non-panic resolution list until all the subdomain names in the subdomain name list are processed.

In a possible implementation manner, the third judging module 304 is specifically configured to:

Carry out similarity calculation for each sub-domain name in the non-pan resolution list, determine the similarity between each sub-domain name and the remaining sub-domain names in the non-pan resolution list; Add the subdomain names with a certain threshold to the final non-pan resolution list and output it.

In a possible implementation manner, the system also includes:

The information acquisition module 301 is also used to obtain the root domain name of the sub-domain name; judge whether there is a pan-analysis behavior according to the root domain name, and if so, proceed to the next step to obtain the sub-domain name list and the sub-domain name information of each sub-domain name; If it does not exist, then end the screening of the root domain name.

In a possible implementation manner, the resolution record of the subdomain name includes the subdomain name and the corresponding root domain name, subdomain resolution data and resolution times, the first resolution time and the last resolution time of the subdomain name.

The embodiment of the present application also provides an electronic device 20 corresponding to the method provided in the foregoing embodiment. Please refer to FIG. 4 , which shows a schematic diagram of an electronic device 20 provided by some embodiments of the present application. The electronic device 20 may include: a processor 200, a memory 201, a bus 202 and a communication interface 203, the processor 200, the communication interface 203 and the memory 201 are connected through the bus 202; A computer program running on the processor 200, when the processor 200 runs the computer program, executes the method provided in any one of the foregoing embodiments of the present application.

Wherein, the memory 201 may include a high-speed random access memory (RAM: Random Access Memory), and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory. The communication connection between the system network element and at least one other network element is realized through at least one physical port (which may be wired or wireless), and the Internet, wide area network, local network, metropolitan area network, etc. can be used.

The bus 202 may be an ISA bus, a PCI bus, or an EISA bus, etc. The bus can be divided into address bus, data bus, control bus and so on. Wherein, the memory 201 is used to store a program, and the processor 200 executes the program after receiving an execution instruction. The method disclosed in any implementation manner of the foregoing embodiments of the present application can be applied to the processor 200, or by The processor 200 implements.

The processor 200 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method may be implemented by an integrated logic circuit of hardware in the processor 200 or instructions in the form of software. The above-mentioned processor 200 can be a general-purpose processor, including a central processing unit (Central Processing Unit, referred to as CPU), a network processor (Network Processor, referred to as NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), Field Programmable Gate Array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. Various methods, steps, and logic block diagrams disclosed in the embodiments of the present application may be implemented or executed. A general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like. The steps of the method disclosed in connection with the embodiments of the present application may be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register. The storage medium is located in the memory 201, and the processor 200 reads the information in the memory 201, and completes the steps of the above method in combination with its hardware.

The electronic device 20 provided in the embodiment of the present application is based on the same inventive concept as the method provided in the embodiment of the present application, and has the same beneficial effect as the method adopted, operated or implemented.

The embodiment of the present application also provides a computer-readable storage medium corresponding to the method provided in the foregoing embodiment. Please refer to FIG. Program product), when the computer program is run by a processor, it will execute the method provided by any of the foregoing implementation manners.

It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random Access memory (RAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other optical and magnetic storage media will not be repeated here.

The computer-readable storage medium provided by the above embodiments of the present application is based on the same inventive concept as the method provided by the embodiments of the present application, and has the same beneficial effect as the method adopted, executed or implemented by the stored application program.

It should be noted:

The algorithms and displays presented herein are not inherently related to any particular computer, virtual appliance, or other device. Various general purpose devices can also be used with the teachings based on this. The structure required to construct such an apparatus will be apparent from the foregoing description. Furthermore, this application is not directed to any particular programming language. It should be understood that various programming languages can be used to implement the content of the application described here, and the description of specific languages above is to disclose the best implementation mode of the application.

In the description provided herein, numerous specific details are set forth. However, it is understood that the embodiments of the application may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure the understanding of this description.

Similarly, it should be understood that in the above description of exemplary embodiments of the application, in order to streamline the application and to facilitate understanding of one or more of the various inventive aspects, various features of the application are sometimes grouped together in a single embodiment, figure, or its description. This method of disclosure, however, is not to be interpreted as reflecting an intention that the claimed application requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following this Detailed Description are hereby expressly incorporated into this Detailed Description, with each claim standing on its own as a separate embodiment of this application.

Those skilled in the art can understand that the modules in the device in the embodiment can be adaptively changed and arranged in one or more devices different from the embodiment. Modules or units or components in the embodiments may be combined into one module or unit or component, and furthermore may be divided into a plurality of sub-modules or sub-units or sub-assemblies. All features disclosed in this specification (including accompanying claims, abstract and drawings) and any method or method so disclosed may be used in any combination, except that at least some of such features and/or processes or units are mutually exclusive. All processes or units of equipment are combined. Each feature disclosed in this specification (including accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.

In addition, those skilled in the art will appreciate that although some embodiments described herein include some features included in other embodiments but not others, combinations of features from different embodiments are meant to be within the scope of the present application. and form different embodiments. For example, in the following claims, any of the claimed embodiments may be used in any combination.

The various component embodiments of the present application may be realized in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art should understand that a microprocessor or a digital signal processor (DSP) may be used in practice to implement some or all functions of some or all components in the device for creating a virtual machine according to the embodiment of the present application. The present application can also be implemented as an apparatus or apparatus program (eg, computer program and computer program product) for performing a part or all of the methods described herein. Such a program implementing the present application may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet site, or provided on a carrier signal, or provided in any other form.

It should be noted that the above-mentioned embodiments illustrate rather than limit the application, and that those skilled in the art will be able to design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The application can be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means can be embodied by one and the same item of hardware. The use of the words first, second, and third, etc. does not indicate any order. These words can be interpreted as names.

The above is only a preferred embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any person familiar with the technical field can easily conceive of changes or changes within the technical scope disclosed in this application Replacement should be covered within the protection scope of this application. Therefore, the protection scope of the present application should be determined by the protection scope of the claims.

Claims (8)

1. A method for domain name resolution in a broad domain, the method comprising:

acquiring a sub domain name list and sub domain name information of each sub domain name; the subdomain name information comprises an analysis record and a survival time value;

traversing all the sub-domain names, and judging whether the sub-domain names with the same resolution record exist in the sub-domain name list according to the resolution record of the sub-domain name to be traversed; if not, adding the subdomain name to be traversed into a non-extensive parsing list;

if so, judging whether the sub domain names with the same survival time value exist in the sub domain name list according to the survival time value of the sub domain name to be traversed; if not, adding the subdomain name to be traversed into the non-extensive parsing list;

if yes, carrying out similarity calculation on each sub-domain name in the non-extensive-resolution list, and determining the similarity between each sub-domain name and the rest sub-domain names in the non-extensive-resolution list; adding the sub-domain names with the similarity lower than a set threshold value in the non-extensive-resolution list into a final non-extensive-resolution list;

and outputting the non-generic resolution list until all the sub-domain names in the sub-domain name list are processed.

2. The method of claim 1, wherein prior to the obtaining the list of sub-domain names and sub-domain name information for each sub-domain name, the method comprises:

acquiring a root domain name of the sub domain name;

judging whether a generic resolution behavior exists according to the root domain name, and if so, performing the next step of obtaining a sub domain name list and sub domain name information of each sub domain name; and if not, ending the screening of the root domain name.

3. The method of claim 1, wherein the resolution record of the sub-domain name includes the sub-domain name and a corresponding root domain name, sub-domain name resolution data, number of times of resolution, sub-domain name first resolution time, and last resolution time.

4. A generalized domain name resolution system, the system comprising:

the information acquisition module is used for acquiring a sub domain name list and sub domain name information of each sub domain name; the subdomain name information comprises an analysis record and a survival time value;

the first judging module is used for traversing all the sub-domain names and judging whether the sub-domain names with the same analysis records exist in the sub-domain name list according to the analysis records of the sub-domain names to be traversed; if not, adding the subdomain name to be traversed into a non-extensive parsing list;

the second judging module is used for judging whether the sub domain names with the same survival time value exist in the sub domain name list according to the survival time value of the sub domain name to be traversed if the sub domain names exist; if not, adding the subdomain name to be traversed into the non-extensive parsing list;

the third judging module is used for carrying out similarity calculation on each sub-domain name in the non-extensive-resolution list if the sub-domain name exists, and determining the similarity between each sub-domain name and the rest sub-domain names in the non-extensive-resolution list; adding the sub-domain names with the similarity lower than a set threshold value in the non-extensive-resolution list into a final non-extensive-resolution list;

and the output module is used for outputting the non-generic resolution list until all the sub domain names in the sub domain name list are processed.

5. The system of claim 4, wherein the system further comprises:

the information acquisition module is also used for acquiring the root domain name of the sub domain name;

judging whether a generic resolution behavior exists according to the root domain name, and if so, performing the next step of obtaining a sub domain name list and sub domain name information of each sub domain name; and if not, ending the screening of the root domain name.

6. The system of claim 4, wherein the resolution record of the sub-domain name includes the sub-domain name and corresponding root domain name, sub-domain name resolution data, number of times of resolution, sub-domain name first resolution time, and last resolution time.

7. An electronic device, comprising: a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the processor executes to implement the method according to any of claims 1-3 when running the computer program.

8. A computer readable storage medium having stored thereon computer readable instructions executable by a processor to implement the method of any of claims 1-3.