CN115955423A - Domain name-based network traffic processing method, device and processing equipment - Google Patents

Abstract

The present application provides a domain name-based network traffic processing method, device and processing equipment, which are used to obtain specific network traffic more concisely and achieve accurate network traffic capture effects. The domain name-based network traffic processing method provided by the present application includes: obtaining network traffic to be processed, wherein the network traffic to be processed is used to analyze whether the network traffic belongs to a preset target object; extracting the network traffic to be processed at the application level The domain name of the sender and the domain name of the sender; according to the domain name of the receiver and the domain name of the sender, determine whether the network traffic to be processed matches the preset domain name matching rule of the target object; if it matches, determine that the network traffic to be processed belongs to the target object of network traffic.

Description

Domain name-based network traffic processing method, device and processing equipment

technical field

The present application relates to the Internet field, and specifically relates to a domain name-based network traffic processing method, device and processing equipment.

Background technique

The Domain Name System (Domain Name System, DNS) protocol is a very important protocol in the computer network, which realizes the conversion between the domain name and the Internet Protocol Address (Internet Protocol Address, IP), and therefore, the DNS device in the network architecture , its DNS traffic network traffic monitoring is easy to focus on the traffic.

However, the inventor of the present application found that due to the large DNS traffic in the network, the traffic monitoring system in the prior art often captures and displays all of them indiscriminately, which means that a large number of storage resources such as hard disks or databases need to be occupied For storage, it is obvious that the application cost is high or the application is inconvenient.

Contents of the invention

The present application provides a domain name-based network traffic processing method, device and processing equipment, which are used to obtain specific network traffic more concisely and achieve accurate network traffic capture effects.

In the first aspect, the present application provides a domain name-based network traffic processing method, the method comprising:

Obtaining network traffic to be processed, wherein the network traffic to be processed is used to analyze whether it belongs to the network traffic of a preset target object;

Extract the domain name of the receiver and the domain name of the sender of the network traffic to be processed at the application level;

According to the domain name of the receiver and the domain name of the sender, determine whether the network traffic to be processed matches the preset domain name matching rule of the target object;

If matched, it is determined that the network traffic to be processed belongs to the network traffic of the target object.

In combination with the first aspect of the present application, in the first possible implementation of the first aspect of the present application, if the network traffic to be processed belongs to the request message type, and the target object is the target session, determine that the network traffic to be processed belongs to the network of the target object After traffic, the method also includes:

Create a log of the target object;

Write the relevant session characteristics of the network traffic to be processed into the log of the target session for storage.

In combination with the first aspect of the present application, in the second possible implementation of the first aspect of the present application, if the network traffic to be processed belongs to the response message type, and the target object is the target session, it is determined that the network traffic to be processed belongs to the network of the target object After traffic, the method also includes:

Write the relevant session characteristics of the network traffic to be processed into the log of the target session for storage.

In combination with the first or second possible implementation of the first aspect of the present application, in the third possible implementation of the first aspect of the present application, the method further includes:

Extracting quintuple information of the network traffic to be processed, wherein the quintuple information specifically includes source IP, destination IP, source port, destination port and protocol type;

According to the five-tuple information, determine whether the network traffic to be processed belongs to the target session.

In combination with the third possible implementation of the first aspect of the present application, in the fourth possible implementation of the first aspect of the present application, if there is no relevant query message or response message for the network traffic to be processed, and the target object is target session, the method also includes:

In the log about the target session of the network traffic to be processed, a missing identifier is added to the network traffic to be processed, wherein the missing identifier is used to indicate that there is no related query packet or response packet in the network traffic to be processed.

In combination with the first aspect of the present application, in the fifth possible implementation of the first aspect of the present application, according to the domain name of the receiver and the domain name of the sender, determine whether the network traffic to be processed matches the preset domain name matching rule of the target object ,include:

Based on the domain name of the receiver and the domain name of the sender, the hyperscan engine is used to determine whether the network traffic to be processed matches the preset domain name matching rules of the target object, wherein the hyperscan engine writes the domain name keywords and corresponding ID numbers for Matching is used.

With reference to the first aspect of the present application, in a sixth possible implementation manner of the first aspect of the present application, the traffic to be processed is specifically the DNS traffic passing through the DNS device.

In a second aspect, the present application provides a domain name-based network traffic processing device, which includes:

The acquiring unit is configured to acquire network traffic to be processed, wherein the network traffic to be processed is used to analyze whether the network traffic belongs to a preset target object;

An extraction unit, configured to extract the domain name of the receiver and the domain name of the sender of the network traffic to be processed at the application level;

The determining unit is configured to determine whether the network traffic to be processed matches the preset domain name matching rule of the target object according to the domain name of the receiver and the domain name of the sender, and if it matches, determine that the network traffic to be processed belongs to the network traffic of the target object.

In combination with the second aspect of the present application, in the first possible implementation of the second aspect of the present application, the device further includes a log processing unit, if the network traffic to be processed belongs to the request message type and the target object is a target session, it is used to:

Create a log of the target object;

Write the relevant session characteristics of the network traffic to be processed into the log of the target session for storage.

In combination with the second aspect of the present application, in the second possible implementation of the second aspect of the present application, the device further includes a log processing unit, if the network traffic to be processed belongs to the response message type and the target object is a target session, it is used to:

Write the relevant session characteristics of the network traffic to be processed into the log of the target session for storage.

In combination with the first or second possible implementation of the second aspect of the present application, in the third possible implementation of the second aspect of the present application, the determining unit is further configured to:

Extracting quintuple information of the network traffic to be processed, wherein the quintuple information specifically includes source IP, destination IP, source port, destination port and protocol type;

According to the five-tuple information, determine whether the network traffic to be processed belongs to the target session.

In combination with the third possible implementation of the second aspect of the present application, in the fourth possible implementation of the second aspect of the present application, the device further includes a log processing unit, if there is no relevant query message or response for the network traffic to be processed message, and the target object is the target session, which is used for:

In the log about the target session of the network traffic to be processed, a missing identifier is added to the network traffic to be processed, wherein the missing identifier is used to indicate that there is no related query packet or response packet in the network traffic to be processed.

With reference to the second aspect of the present application, in a fifth possible implementation manner of the second aspect of the present application, the determining unit is specifically configured to:

Based on the domain name of the receiver and the domain name of the sender, the hyperscan engine is used to determine whether the network traffic to be processed matches the preset domain name matching rules of the target object, wherein the hyperscan engine writes the domain name keywords and corresponding ID numbers for Matching is used.

With reference to the second aspect of the present application, in a sixth possible implementation manner of the second aspect of the present application, the traffic to be processed is specifically the DNS traffic passing through the DNS device.

In a third aspect, the present application provides a processing device, including a processor and a memory, and a computer program is stored in the memory. When the processor calls the computer program in the memory, it executes any one of the first aspect of the present application or the first aspect of the present application. A method provided by a possible implementation.

In a fourth aspect, the present application provides a computer-readable storage medium. The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute any one of the first aspect of the present application or the first aspect of the present application. A method provided by a possible implementation.

Can draw from above content, the application has following beneficial effect:

For the capture requirements of specific network traffic, this application starts from the application layer of the network traffic to be processed, determines the domain name of the receiver and the domain name of the sender, and then combines the domain name matching rules of the target object to determine the relationship between the network traffic to be processed and the target object Under the convenient processing framework, it is unnecessary to pay attention to and analyze the specific traffic content, and obtain specific network traffic (network traffic of the target object) more concisely to achieve accurate network traffic capture effect.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings that need to be used in the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application. For those skilled in the art, other drawings can also be obtained based on these drawings without any creative effort.

Fig. 1 is a schematic flow chart of the domain name-based network traffic processing method of the present application;

Fig. 2 is a kind of work flowchart of domain name matching processing of the present application;

FIG. 3 is a schematic structural diagram of a domain name-based network traffic processing device of the present application;

Fig. 4 is a schematic structural diagram of the processing equipment of the present application.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the application with reference to the drawings in the embodiments of the application. Apparently, the described embodiments are only some of the embodiments of the application, not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without making creative efforts belong to the scope of protection of this application.

The terms "first", "second" and the like in the specification and claims of the present application and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific sequence or sequence. It is to be understood that the terms so used are interchangeable under appropriate circumstances such that the embodiments described herein can be practiced in sequences other than those illustrated or described herein. Furthermore, the terms "comprising" and "having", as well as any variations thereof, are intended to cover a non-exclusive inclusion, for example, a process, method, system, product or device comprising a series of steps or modules is not necessarily limited to the expressly listed Instead, other steps or modules not explicitly listed or inherent to the process, method, product or apparatus may be included. The naming or numbering of the steps in this application does not mean that the steps in the method flow must be executed in the time/logic sequence indicated by the naming or numbering. The execution order of the technical purpose is changed, as long as the same or similar technical effect can be achieved.

The division of modules presented in this application is a logical division. In actual applications, there may be other division methods. For example, multiple modules can be combined or integrated into another system, or some features can be ignored. , or not implemented. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, and the indirect coupling or communication connection between modules may be electrical or other similar forms. Applications are not limited. Moreover, the modules or sub-modules described as separate components may or may not be physically separated, may or may not be physical modules, or may be distributed into multiple circuit modules, and some or all of them may be selected according to actual needs module to achieve the purpose of this application scheme.

Before introducing the domain name-based network traffic processing method provided by this application, first introduce the background content involved in this application.

The domain name-based network traffic processing method, device, and computer-readable storage medium provided by the present application can be applied to processing equipment to obtain specific network traffic more concisely and achieve accurate network traffic capture effects.

The domain name-based network traffic processing method mentioned in this application can be executed by a domain name-based network traffic processing device, or a server, physical host or user equipment (User Equipment, UE) that integrates the domain name-based network traffic processing device. ) and other different types of processing equipment. Among them, the network traffic processing device based on the domain name can be implemented in the form of hardware or software, and the UE can specifically be a terminal device such as a smart phone, a tablet computer, a notebook computer, a desktop computer or a personal digital assistant (Personal Digital Assistant, PDA), and the processing device It can be set by device cluster.

It should be understood that the processing device only needs to have the ability to execute the functional services involved in the domain name-based network traffic processing method of this application, so the form of the device and the structure of the device where it is located can be adaptively adjusted according to actual needs , and back to the network architecture scenario, obviously, the processing device can directly be a specific network device node that needs to capture and monitor traffic in the network architecture, so that the network device node itself can use its own domain name-based network traffic processing method to Realize convenient and accurate traffic capture effect.

Next, start to introduce the domain name-based network traffic processing method provided by this application.

First, referring to FIG. 1, FIG. 1 shows a schematic flowchart of the domain name-based network traffic processing method of the present application. The domain name-based network traffic processing method provided by the present application may specifically include the following steps S101 to S105:

Step S101, acquiring network traffic to be processed, wherein the network traffic to be processed is used to analyze whether the network traffic belongs to a preset target object;

It can be understood that, corresponding to the network traffic analysis scenario involved in this application, the first thing to do is to determine the current or current network traffic that needs to be processed. For the convenience of description, it is recorded as the network traffic to be processed.

Wherein, the network traffic to be processed may be real-time monitored traffic or historically monitored traffic. In addition, the acquisition processing of the network traffic to be processed may be the acquisition process initiated by the processing device itself, It can also be to receive the traffic transmitted by other devices for processing according to the network traffic analysis scenario involved in this application. Obviously, it has high flexibility in practical application and can be adjusted according to actual needs.

In addition, this application is proposed based on the defects of the DNS traffic involved in the prior art. Therefore, the network traffic to be processed can be specifically DNS traffic. Of course, in practical applications, considering that in addition to DNS traffic, this application It can also achieve simple and accurate capture effects on other types of network traffic, so it can also be applied to other types of network traffic or other device nodes.

As for the DNS traffic itself that this application is mainly aimed at, as a specific implementation, the traffic to be processed can specifically be the DNS traffic passing through the DNS device. Therefore, this application can focus on the NDS device, and the DNS traffic passing through it can be The specific network traffic is easily and accurately captured in the traffic, which can be used by related data applications.

For the convenience of description, the following content uses DNS traffic as an example for introduction.

Step S102, extracting the domain name of the receiver and the domain name of the sender of the network traffic to be processed at the application level;

It can be understood that the capture of network traffic in this application does not focus on the actual content to be transmitted, but distinguishes network traffic by its domain name.

In this way, domain name extraction can be performed starting from the application layer. Specifically, the domain name of the receiver and the domain name of the sender are extracted from the specific position of the domain name in the application layer data of the network traffic to be processed. Lay the foundation for subsequent domain name identification.

Step S103, according to the domain name of the recipient and the domain name of the sender, determine whether the network traffic to be processed matches the preset domain name matching rule of the target object, and if so, trigger step S104;

It can be understood that the accurate capture of the network traffic analysis done in this application is based on the domain name. Therefore, domain name matching rules can be pre-configured, so that the corresponding domain name can be adapted in subsequent applications, so that Identify specific network traffic.

Among them, the domain name matching rule is configured based on the corresponding object. Under this setting, each domain name matching rule corresponds to an object. In this way, the determined specific network traffic corresponds to a specific object. Based on the effect of capturing network traffic with specific object targets.

Correspondingly, after determining the domain name of the receiver and the domain name of the sender of the current network traffic to be processed, it can be matched with the preset domain name matching rules of the target object. If there is a match, obviously, it can be Network traffic identified as being relevant to the target object.

It is worth adding that the target object can be one object or multiple objects, and each object can be configured with its own corresponding domain name matching rule.

Step S104, determining that the network traffic to be processed belongs to the network traffic of the target object.

After it is determined that there is a matching situation, the current network traffic to be processed can be determined as the network traffic belonging to the target object according to a specific result determination mechanism.

Wherein, the determination process can obviously be performed according to actual needs, and generally it is adjusted for the application of relevant data of specific captured network traffic later.

As can be seen from the embodiment shown in Figure 1, for the capture requirements of specific network traffic, this application starts from the application layer of the network traffic to be processed, determines the domain name of the receiver and the domain name of the sender, and then combines the domain name matching rules of the target object , to determine the matching relationship between the network traffic to be processed and the target object. Under this convenient processing framework, it is unnecessary to pay attention to and analyze the specific traffic content, and obtain specific network traffic (network traffic of the target object) more concisely , to achieve accurate network traffic capture effect.

Continue to describe in detail the various steps of the above embodiment shown in FIG. 1 and their possible implementations in practical applications.

It can be understood that the execution unit for capturing network traffic in this application, that is, the specific object mentioned above, can specifically be a session, that is to say, this application can be specific to a specific session (for example, there is a specific conversational party, a specific time point, etc. Specific session features) to accurately capture the corresponding network traffic. In network work, it can involve not only operational business considerations, but also network security considerations. Obviously, it has outstanding practical value.

For example, according to the quintuple information, the packets requested by the network are distinguished by session. If the quintuples are the same, or only the source IP and destination IP are swapped, it can be directly considered as belonging to the same session.

As an example, a hash (hash) calculation can be performed according to the five-tuple information, and a hash table can be generated as a session table, so that it is convenient to quickly query the session to which a message belongs.

Among them, the session table data structure can be configured as follows:

Correspondingly, for the subsequent determination of whether it belongs to the target session, the method of this application may also include the following content:

Extracting quintuple information of the network traffic to be processed, wherein the quintuple information specifically includes source IP, destination IP, source port, destination port and protocol type;

According to the five-tuple information, determine whether the network traffic to be processed belongs to the target session.

Wherein, between the quintuple information of the network traffic to be processed and the quintuple information specific to the target session, the source IP and the destination IP may be set to be the same or exchanged.

Furthermore, in the present application, when the network traffic is presented in the form of a message, it can also be divided into two types: request and response, that is, the request message type and the response message type, so as to carry out network traffic with a smaller granularity analyze.

In the process of network traffic analysis, log factors can also be introduced to provide more detailed feature labeling effects for the traffic capture processing of session units, so that concise analysis and processing of captured network traffic can be provided later. And rich feature reference.

Specifically, as yet another specific implementation, if the network traffic to be processed belongs to the request message type, and the target object is a target session, after step S104 determines that the network traffic to be processed belongs to the network traffic of the target object, the method of the present application can also include:

Create a log of the target object;

Write the relevant session characteristics of the network traffic to be processed into the log of the target session for storage.

It can be understood that each session is triggered by a request message. If the session is advanced normally later, there will be a corresponding response message. In this way, when it is determined that there is a request message corresponding to the target session, you can first create The corresponding log, and write the relevant session characteristics of the current response message (current network traffic to be processed) into the log, and store the characteristics for subsequent use.

After the log of the target session is created according to the request message, subsequent messages belonging to the same target session can continue to extract its session features and continue to be written into the log, thus forming a complete session feature record of the target session Effect.

Correspondingly, there is another situation where the currently processed message is already a response message type, that is, if the network traffic to be processed belongs to the response message type, and the target object is a target session, then step S104 determines After the network traffic to be processed belongs to the network traffic of the target object, the method of the present application may also include:

Write the relevant session characteristics of the network traffic to be processed into the log of the target session for storage.

It can be understood that the log written here was previously created according to the trigger of the corresponding request message.

For the session features of the response message, in addition to the basic session features that can be extracted from the request message, such as the domain name and corresponding IP, it can also involve the session features related to the response, such as the query return code and response time.

In addition, this application also takes into account the interference of abnormal factors such as network fluctuations, packet out-of-sequence, or packet loss that may exist in practical applications, resulting in the absence of request packets or response packets in a session, such as the first received DNS response message, or only received DNS query message without corresponding response, so in the network traffic-related logs, obviously due to the lack of requests, there will also be a lack of records of the session characteristics of related requests. For this situation, this The application can also be marked to record the relevant conversation more accurately and delicately, and continue to improve the recorded content.

Specifically, if there is no relevant query message or response message in the network traffic to be processed, as another specific implementation, the application method may also include:

In the log of the network traffic to be processed, a missing identifier is added to the network traffic to be processed, wherein the missing identifier is used to indicate that there is no related query message or response message in the network traffic to be processed.

It is easy to understand that through the configuration of the missing flag, the missing corresponding message of the same session is clearly and concisely marked.

In addition, corresponding to the settings of this application to capture network traffic for sessions and configure session-corresponding logs, the configuration of the missing identification here can be directly configured in the logs to continue to improve the content recorded in the session-corresponding logs.

Correspondingly, in yet another specific implementation manner, the target object is the target session, and in the log of the network traffic to be processed, a missing identifier is added to the network traffic to be processed, which may specifically include the following content:

In the log about the target session of the network traffic to be processed, a missing identifier is added to the network traffic to be processed, wherein the missing identifier is used to indicate that there is no related query packet or response packet in the network traffic to be processed.

In addition, for the matching processing involved in this application, that is, the matching processing based on the domain name matching rules of the target object in advance, it can be understood that the staff can pre-set the domain name matching rules involved, and each rule contains It can contain several domain names. These rules indicate the corresponding domain names of the DNS traffic that the staff should pay attention to. Then the system parses the received DNS messages to obtain their domain name information, and matches them in the user preset rule list to check whether for traffic of interest.

In addition, for the use of logs, an update mechanism can also be introduced. After completing subsequent applications (such as for front-end interface query display or other purposes), data clearing operations and log structure data space release operations can also be performed. Subsequent traffic capture processing of other network traffic to be processed provides a more favorable processing environment, which is beneficial to the overall data processing effect.

During this process, the application found that if the conventional practice is followed, when performing domain name matching, character strings are compared one by one against the domain name rules, in the case of large DNS traffic and/or many domain name matching rules, it is likely to become a system bottleneck, it is difficult to undertake massive matching processing per unit time.

Therefore, as yet another specific implementation, this application introduces a hyperscan matching engine to perform matching processing, that is, step S103 determines whether the network traffic to be processed is consistent with the preset target object according to the domain name of the receiver and the domain name of the sender. The domain name matching rules match, which can include:

Based on the domain name of the receiver and the domain name of the sender, the hyperscan engine is used to determine whether the network traffic to be processed matches the preset domain name matching rules of the target object, wherein the hyperscan engine writes the domain name keywords and corresponding ID numbers for Matching is used.

For the hyperscan engine, it is a regular expression engine focusing on high-performance multi-mode and streaming matching, which can quickly and effectively complete domain name matching and directly return matching results, greatly improving matching efficiency.

To illustrate with an example, if the administrator on the DNS device side wants to monitor the DNS traffic for domain names XXX.com and YYY.com in the network, he can configure the corresponding domain name rule 1 and domain name rule 2, which include the above two domain names respectively. .

During the configuration process of the hyperscan engine, two corresponding rule_ids can be generated, and the rule_id is unique locally to distinguish different rules, and then add the two domain names of XXX.com and YYY.com as keywords to the keyword array (here Keyword information can be formed according to the grammatical rules of regular expressions according to needs, so as to realize exact matching or fuzzy matching);

At the same time, the respective rule_id is added to the id number array as a keyword number, and then returned as a matching result.

Then call the compiling API interface of hyperscan to compile. The API requires the input of keyword array and id number array, so that the keyword information and rule_id involved in the domain name matching rules of the two domain names of XXX.com and YYY.com are added to hyperscan In the engine database, the hyperscan engine can start its corresponding domain name matching process.

In the specific process of domain name matching, you can call the matching API of hyperscan for matching. This API requires a user-defined callback function to perform the operation after matching. This function can directly return the rule_id of the matching rule. In order to be able to find which rule is matched.

For the convenience of understanding the above content, it can also be understood in conjunction with a workflow flowchart of domain name matching processing of the present application shown in FIG. 2 .

After the domain name-based network traffic capture is completed, as mentioned above, the corresponding data application can be launched to achieve the effect of data application with a precise range of network traffic, such as the log application involved above.

In addition, other types of data applications can be performed according to system characteristics or application requirements, such as displaying logs, counting the proportion of DNS traffic matching, drawing domain name and IP correlation diagrams, etc., which can be flexibly adjusted according to the actual situation, and due to processing Objects, that is, network traffic captured based on domain names, have a highly accurate capture effect, so it can bring highly accurate data application effects.

The above is the introduction of the domain name-based network traffic processing method provided by this application. In order to better implement the domain name-based network traffic processing method provided by this application, this application also provides a domain name-based network traffic processing method from the perspective of functional modules. Processing device.

Referring to FIG. 3, FIG. 3 is a schematic structural diagram of a domain name-based network traffic processing device in this application. In this application, the domain name-based network traffic processing device 300 may specifically include the following structure:

The obtaining unit 301 is configured to obtain network traffic to be processed, wherein the network traffic to be processed is used to analyze whether the network traffic belongs to a preset target object;

An extraction unit 302, configured to extract the domain name of the receiver and the domain name of the sender of the network traffic to be processed at the application level;

The determining unit 303 is configured to determine whether the network traffic to be processed matches the preset domain name matching rule of the target object according to the domain name of the receiver and the domain name of the sender, and if it matches, determine that the network traffic to be processed belongs to the network traffic of the target object .

In an exemplary implementation, the device further includes a log processing unit 304, configured to:

Create a log of the target object;

Write the relevant session characteristics of the network traffic to be processed into the log of the target session for storage.

In yet another exemplary implementation, the device further includes a log processing unit 304, configured to:

Write the relevant session characteristics of the network traffic to be processed into the log of the target session for storage.

In yet another exemplary implementation manner, the determining unit 303 is further configured to:

Extracting quintuple information of the network traffic to be processed, wherein the quintuple information specifically includes source IP, destination IP, source port, destination port and protocol type;

According to the five-tuple information, determine whether the network traffic to be processed belongs to the target session.

In yet another exemplary implementation, the device further includes a log processing unit 304, if there is no related query message or response message in the network traffic to be processed, and the target object is a target session, configured to:

In the log about the target session of the network traffic to be processed, a missing identifier is added to the network traffic to be processed, wherein the missing identifier is used to indicate that there is no related query packet or response packet in the network traffic to be processed.

In yet another exemplary implementation manner, the determining unit 303 is specifically configured to:

Based on the domain name of the receiver and the domain name of the sender, the hyperscan engine is used to determine whether the network traffic to be processed matches the preset domain name matching rules of the target object, wherein the hyperscan engine writes the domain name keywords and corresponding ID numbers for Matching is used.

In yet another exemplary implementation manner, the traffic to be processed is specifically DNS traffic passing through the DNS device.

The present application also provides a processing device from the perspective of hardware structure. Referring to FIG. 4, FIG. 4 shows a schematic structural diagram of the processing device of the present application. The output device 403, the processor 401 is used to execute the computer program stored in the memory 402 to implement the steps of the domain name-based network traffic processing method in the corresponding embodiment as shown in Figure 1; or, the processor 401 is used to execute the computer program stored in the memory 402 The computer program implements the functions of each unit in the embodiment corresponding to FIG. 3 , and the memory 402 is used to store the computer program required by the processor 401 to execute the domain name-based network traffic processing method in the embodiment corresponding to FIG. 1 .

Exemplarily, the computer program can be divided into one or more modules/units, and one or more modules/units are stored in the memory 402 and executed by the processor 401 to complete the present application. One or more modules/units may be a series of computer program instruction segments capable of accomplishing specific functions, and the instruction segments are used to describe the execution process of the computer program in the computer device.

The processing device may include, but not limited to, a processor 401 , a memory 402 , and an input and output device 403 . Those skilled in the art can understand that the illustration is only an example of a processing device, and does not constitute a limitation to the processing device, and may include more or less components than those shown in the illustration, or combine some components, or different components, such as processing The device may also include a network access device, a bus, etc., and the processor 401, memory 402, input and output device 403, etc. are connected through the bus.

The processor 401 can be a central processing unit (Central Processing Unit, CPU), and can also be other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), application specific integrated circuits (Application Specific Integrated Circuit, ASIC), on-site Field-Programmable Gate Array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the processing device and uses various interfaces and lines to connect various parts of the entire device.

The memory 402 can be used to store computer programs and/or modules, and the processor 401 realizes various functions of the computer device by running or executing the computer programs and/or modules stored in the memory 402 and calling data stored in the memory 402 . The memory 402 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application program required by at least one function, etc.; the data storage area may store data created according to the use of the processing device, etc. In addition, the memory may include a high-speed random access memory, and may also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, A flash card (Flash Card), at least one magnetic disk storage device, flash memory device, or other volatile solid-state storage device.

When the processor 401 is used to execute the computer program stored in the memory 402, it can specifically realize the following functions:

Obtaining network traffic to be processed, wherein the network traffic to be processed is used to analyze whether it belongs to the network traffic of a preset target object;

Extract the domain name of the receiver and the domain name of the sender of the network traffic to be processed at the application level;

According to the domain name of the receiver and the domain name of the sender, determine whether the network traffic to be processed matches the preset domain name matching rule of the target object;

If matched, it is determined that the network traffic to be processed belongs to the network traffic of the target object.

Those skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the domain name-based network traffic processing device, processing equipment and corresponding units described above can be referred to in the corresponding embodiment as shown in Figure 1. The description of the network traffic processing method of the domain name will not be repeated here.

Those of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructions, or by instructions controlling related hardware, and the instructions can be stored in a computer-readable storage medium, and is loaded and executed by the processor.

To this end, the present application provides a computer-readable storage medium, which stores a plurality of instructions that can be loaded by a processor to execute the steps of the domain name-based network traffic processing method in the corresponding embodiment of the present application as shown in Figure 1 For specific operations, reference may be made to the description of the domain name-based network traffic processing method in the corresponding embodiment shown in FIG. 1 , which will not be repeated here.

Wherein, the computer-readable storage medium may include: a read-only memory (Read Only Memory, ROM), a random access memory (Random Access Memory, RAM), a magnetic disk or an optical disk, and the like.

Because the instructions stored in the computer-readable storage medium can execute the steps of the domain name-based network traffic processing method in the embodiment corresponding to Figure 1 of this application, therefore, the domain name-based network traffic processing method in the embodiment corresponding to Figure 1 of this application can be realized For the beneficial effects that can be achieved by the network traffic processing method, refer to the previous description for details, and will not be repeated here.

The domain name-based network traffic processing method, device, processing equipment, and computer-readable storage medium provided by this application have been described above in detail. This article uses specific examples to illustrate the principle and implementation of this application. The above embodiments The description is only used to help understand the method of the present application and its core idea; at the same time, for those skilled in the art, according to the idea of the present application, there will be changes in the specific implementation and scope of application. In summary, The contents of this specification should not be understood as limiting the application.

Claims (10)

1. A method for processing network traffic based on a domain name, characterized in that the method comprises: Obtaining network traffic to be processed, wherein the network traffic to be processed is used to analyze whether the network traffic belongs to a preset target object; Extracting the domain name of the receiver and the domain name of the sender of the network traffic to be processed at the application level; According to the domain name of the receiver and the domain name of the sender, determine whether the network traffic to be processed matches the preset domain name matching rule of the target object; If they match, it is determined that the network traffic to be processed belongs to the network traffic of the target object. 2. The method according to claim 1, wherein if the network traffic to be processed belongs to a request message type, and the target object is a target session, the determination that the network traffic to be processed belongs to the target After the object's network traffic, the method also includes: create a log of said target object; Writing the relevant session characteristics of the network traffic to be processed into the log of the target session for storage. 3. The method according to claim 1, wherein if the network traffic to be processed belongs to a response message type, and the target object is a target session, the determination that the network traffic to be processed belongs to the target After the object's network traffic, the method also includes: Writing the relevant session characteristics of the network traffic to be processed into the log of the target session for storage. 4. The method according to claim 2 or 3, characterized in that the method further comprises: Extracting the five-tuple information of the network traffic to be processed, wherein the five-tuple information specifically includes source IP, destination IP, source port, destination port and protocol type; Determine whether the network traffic to be processed belongs to the target session according to the five-tuple information. 5. The method according to claim 4, wherein if there is no relevant query message or response message in the network traffic to be processed, and the target object is a target session, the method further comprises: In the log of the network traffic to be processed about the target session, add the missing identifier for the network traffic to be processed, wherein the missing identifier is used to identify that there is no relevant query report for the network traffic to be processed message or response message. 6. The method according to claim 1, wherein, according to the domain name of the receiver and the domain name of the sender, it is determined whether the network traffic to be processed is consistent with the preset domain name of the target object Matching rules match, including: Based on the domain name of the receiver and the domain name of the sender, the hyperscan engine determines whether the network traffic to be processed matches the preset domain name matching rule of the target object, wherein the hyperscan engine writes Enter the domain name keywords and corresponding ID numbers for matching. 7. The method according to claim 1, wherein the traffic to be processed is specifically DNS traffic passing through a DNS device. 8. A network traffic processing device based on a domain name, characterized in that the device comprises: An acquisition unit, configured to acquire network traffic to be processed, wherein the network traffic to be processed is used to analyze whether the network traffic belongs to a preset target object; An extraction unit, configured to extract the domain name of the receiver and the domain name of the sender of the network traffic to be processed at the application level; A determining unit, configured to determine whether the network traffic to be processed matches the preset domain name matching rule of the target object according to the domain name of the receiver and the domain name of the sender, and if so, determine that the network traffic to be processed matches the preset domain name matching rule of the target object. Processing network traffic belonging to the target object. 9. A processing device, characterized in that it comprises a processor and a memory, a computer program is stored in the memory, and when the processor invokes the computer program in the memory, it executes the process described in any one of claims 1 to 7. described method. 10. A computer-readable storage medium, characterized in that the computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the method described in any one of claims 1 to 7. method.

Images