CN115021969A - Broadband account number determination method and device - Google Patents

Broadband account number determination method and device Download PDF

Info

Publication number
CN115021969A
CN115021969A CN202210504688.1A CN202210504688A CN115021969A CN 115021969 A CN115021969 A CN 115021969A CN 202210504688 A CN202210504688 A CN 202210504688A CN 115021969 A CN115021969 A CN 115021969A
Authority
CN
China
Prior art keywords
time
target
dns
address
aaa authentication
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202210504688.1A
Other languages
Chinese (zh)
Inventor
罗剑平
丁开生
黄平
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
China Telecom Corp Ltd
Original Assignee
China Telecom Corp Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by China Telecom Corp Ltd filed Critical China Telecom Corp Ltd
Priority to CN202210504688.1A priority Critical patent/CN115021969A/en
Publication of CN115021969A publication Critical patent/CN115021969A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0892—Network architectures or network communication protocols for network security for authentication of entities by using authentication-authorization-accounting [AAA] servers or protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint

Abstract

The application provides a broadband account number determining method and device. The method comprises the following steps: extracting DNS analysis information and AAA authentication information of a target website in the current day; determining a target IP address, a broadband account number associated with the target IP address, DNS analysis time and AAA authentication time according to the DNS analysis information and the AAA authentication information; grouping DNS analysis time to generate DNS analysis time groups, and acquiring the latest target DNS analysis time in each DNS analysis time group; calculating a time difference between each DNS resolution time and AAA authentication time for each DNS resolution time packet; acquiring target AAA authentication time according to the time difference; and determining the target broadband account corresponding to the target IP address in the current day according to the AAA authentication information and the target AAA authentication time. The method and the device can quickly and accurately identify the IP address in the appointed application log as a real broadband user.

Description

Broadband account number determination method and device
Technical Field
The application relates to the technical field of data analysis, in particular to a broadband account number determining method and device.
Background
With the rapid development of internet technology, more and more users access the internet, and the IP addresses of the users can be obtained through logs on the application side, but because the IP addresses are dynamically allocated by dial-up users each time the dial-up users surf the internet, the same IP addresses are not necessarily the same user, and in order to better characterize the users, the users need to be accurately identified, and therefore, the IP addresses in the application logs need to be restored to real dial-up account users.
At present, the commonly adopted method for restoring an IP address to a real broadband account user is as follows: when a client application program receives a batch of IP address identification requests, it needs to query a broadband account in an AAA (Authentication, Authorization, Accounting) Authentication log library in real time within a period of time, however, because the log is continuously updated, the real broadband user corresponding to the IP address is difficult to be quickly and accurately identified by this positioning method.
Disclosure of Invention
The technical problem to be solved by the embodiments of the present application is to provide a method and an apparatus for determining a broadband account, so as to solve the technical problem that it is difficult to quickly and accurately identify a real broadband user corresponding to an IP address in an identification manner in the prior art.
In order to solve the technical problem, an embodiment of the present application provides a method for determining a broadband account, including:
extracting DNS (Domain Name System) resolution information and AAA (Authentication, Authorization and Accounting) Authentication information of a target website in the current day;
determining a target IP address, a broadband account number associated with the target IP address, DNS analysis time and AAA authentication time according to the DNS analysis information and the AAA authentication information;
grouping the DNS analysis time according to a set time length to generate a plurality of DNS analysis time groups, and acquiring the latest target DNS analysis time in each DNS analysis time group;
calculating a time difference between each DNS resolution time and the AAA authentication time for each DNS resolution time packet;
acquiring target AAA authentication time with the closest time distance corresponding to the target DNS analysis time in each DNS analysis time packet according to the time difference;
and determining a target broadband account corresponding to the target IP address in the current day according to the AAA authentication information and the target AAA authentication time.
Optionally, the DNS resolution information includes: the first IP address and DNS resolution time, and the AAA authentication information comprises: the second IP address and the AAA authentication time,
the determining a target IP address, a broadband account number associated with the target IP address, DNS analysis time and AAA authentication time according to the DNS analysis information and the AAA authentication information comprises the following steps:
acquiring the same IP address in the first IP address and the second IP address, and taking the same IP address as a target IP address;
and determining the broadband account number, DNS analysis time and AAA authentication time associated with the target IP address according to the DNS analysis information and AAA authentication information corresponding to the target IP address.
Optionally, said calculating, for each DNS resolution time packet, a time difference between each DNS resolution time and the AAA authentication time comprises:
for each DNS analysis time packet, matching every two DNS analysis times in the DNS analysis time packet with AAA authentication time to generate a time matching list;
and calculating the time difference between the DNS resolution time and the AAA authentication time in each time matching list.
Optionally, after the calculating a time difference between the DNS resolution time and the AAA authentication time in each of the time matching lists, the method further includes:
and filtering out the time matching lists with the time difference being a negative value.
Optionally, before obtaining, according to the time difference, a target AAA authentication time whose time distance corresponding to the target DNS resolution time in each DNS resolution time packet is closest to the target DNS resolution time, the method further includes:
sequencing the AAA authentication time according to a set time sequence to obtain an authentication time sequencing result;
the obtaining the target AAA authentication time with the closest time distance corresponding to the target DNS analysis time in each DNS analysis time packet according to the time difference comprises the following steps:
acquiring a target time list with the minimum time difference corresponding to the target DNS analysis time in the filtered time matching list;
and determining the target AAA authentication time according to the target time list.
In a second aspect, an embodiment of the present application provides a broadband account determination apparatus, including:
a DNS information extraction module, configured to extract DNS (Domain Name System) resolution information and AAA (Authentication, Authorization, and Accounting) Authentication information of a target website in the current day;
a target IP determining module, configured to determine a target IP address, and a broadband account, DNS resolution time, and AAA authentication time associated with the target IP address according to the DNS resolution information and the AAA authentication information;
the target DNS time acquisition module is used for grouping the DNS analysis time according to set time length to generate a plurality of DNS analysis time groups and acquiring the latest target DNS analysis time in each DNS analysis time group;
a time difference calculation module for calculating a time difference between each DNS resolution time and the AAA authentication time for each DNS resolution time packet;
a target authentication time obtaining module, configured to obtain, according to the time difference, a target AAA authentication time whose time distance corresponding to the target DNS resolution time in each DNS resolution time packet is the closest;
and the target broadband account determining module is used for determining a target broadband account corresponding to the target IP address in the current day according to the AAA authentication information and the target AAA authentication time.
Optionally, the DNS resolution information includes: the first IP address and the DNS resolution time, and the AAA authentication information includes: the second IP address and the AAA authentication time,
the target IP determining module comprises:
a target IP obtaining unit, configured to obtain a same IP address of the first IP address and the second IP address, and use the same IP address as a target IP address;
and the broadband account determining unit is used for determining the broadband account, DNS analysis time and AAA authentication time associated with the target IP address according to the DNS analysis information and the AAA authentication information corresponding to the target IP address.
Optionally, the time difference calculating module includes:
a time matching list generating unit, configured to match, for each DNS resolution time packet, every DNS resolution time and AAA authentication time in the DNS resolution time packet to generate a time matching list;
and the time difference calculating unit is used for calculating and obtaining the time difference between the DNS analysis time and the AAA authentication time in each time matching list.
Optionally, the apparatus further comprises:
and the time matching list filtering module is used for filtering the time matching list with the time difference being a negative value in the time matching list.
Optionally, the apparatus further comprises:
the authentication time sequencing result acquisition module is used for sequencing the AAA authentication time according to a set time sequence to obtain an authentication time sequencing result;
the target authentication time acquisition module includes:
a target time list obtaining unit, configured to obtain a target time list with a minimum time difference corresponding to the target DNS resolution time in the filtered time matching list;
and the target authentication time determining unit is used for determining the target AAA authentication time according to the target time list.
In a third aspect, an embodiment of the present application provides an electronic device, including:
the system comprises a processor, a memory and a computer program stored on the memory and capable of running on the processor, wherein the processor executes the program to realize the broadband account number determination method.
In a fourth aspect, the present application further provides a computer-readable storage medium, where instructions in the storage medium, when executed by a processor of an electronic device, enable the electronic device to perform any one of the above-mentioned broadband account determination methods.
Compared with the prior art, the embodiment of the application has the following advantages:
in the embodiment of the application, a target IP address, a broadband account number associated with the target IP address, DNS resolution time and AAA authentication time are determined according to DNS resolution information and AAA authentication information by extracting the DNS resolution information and the AAA authentication information of a target website in the current day, the DNS resolution time is subjected to grouping processing according to set time length to generate a plurality of DNS resolution time packets, the latest target DNS resolution time in each DNS resolution time packet is obtained, time difference between each DNS resolution time and the AAA authentication time is calculated for each DNS resolution time packet, the target AAA authentication time with the closest time distance corresponding to the target DNS resolution time in each DNS resolution time packet is obtained according to the time difference, and the broadband account number corresponding to the target IP address in the current day is determined according to the AAA authentication information and the target AAA authentication time. According to the embodiment of the application, the DNS analysis information and the AAA authentication information are subjected to data grouping according to the set duration, so that the matching efficiency can be improved, and the identification accuracy of the broadband account corresponding to the IP address can be improved by adopting a time difference matching and identifying mode.
It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the application.
Drawings
Fig. 1 is a flowchart illustrating steps of a method for determining a broadband account according to an embodiment of the present disclosure;
fig. 2 is a flowchart illustrating steps of a method for determining a target IP address according to an embodiment of the present disclosure;
fig. 3 is a flowchart illustrating steps of a time difference calculating method according to an embodiment of the present application;
fig. 4 is a schematic diagram illustrating a batch client IP address identification as a broadband user according to an embodiment of the present application;
fig. 5 is a schematic structural diagram of a broadband account determining apparatus according to an embodiment of the present application;
fig. 6 is a schematic structural diagram of an electronic device according to an embodiment of the present application.
Detailed Description
In order to make the aforementioned objects, features and advantages of the present application more comprehensible, the present application is described in further detail with reference to the accompanying drawings and the detailed description.
The terminology used in the embodiments of the present application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. As used in the examples of this application and the appended claims, the singular forms "a", "an", and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.
Example one
Referring to fig. 1, a flowchart illustrating steps of a broadband account determination method provided in an embodiment of the present application is shown, and as shown in fig. 1, the broadband account determination method may specifically include the following steps:
step 101: and extracting DNS (Domain Name System) resolution information and AAA (Authentication, Authorization and Accounting) Authentication information of the target website in the current day.
In the embodiment of the application, the target website refers to a website capable of performing broadband account identification.
The DNS (domain name system) is a distributed system database that maps domain names and IP addresses to each other.
AAA authentication refers to broadband user access authentication and comprises information such as a user internet account, a user IP address, an access event reporting event and the like.
When all broadband accounts corresponding to the target IP addresses of the target websites accessed on the same day need to be identified, DNS analysis information and AAA authentication information of the target websites in the same day can be extracted, and specifically, the DNS analysis information and the AAA authentication information can be obtained through logs generated by the target websites in the same day.
After extracting the DNS resolution information and AAA authentication information of the target website within the current day, step 102 is performed.
Step 102: and determining a target IP address, a broadband account number associated with the target IP address, DNS analysis time and AAA authentication time according to the DNS analysis information and the AAA authentication information.
The target IP address refers to an IP address used for analyzing and allocating to all broadband accounts, in this embodiment, the target IP address may be one IP address, or may be multiple IP addresses, specifically, the number of the target IP addresses may be determined according to an actual situation, which is not limited in this embodiment.
After extracting the DNS resolution information and the AAA authentication information of the target website in the current day, the target IP address, the broadband account, the DNS resolution time, and the AAA authentication time associated with the target IP address may be determined according to the DNS resolution information and the AAA authentication information, specifically, both the DNS resolution information and the AAA authentication information include the user IP address, the same IP address in the DNS resolution information and the AAA authentication information may be used as the target IP address, and the broadband account, the DNS resolution time, and the AAA authentication time associated with the target IP address may be extracted from the DNS resolution information and the AAA authentication information, which may be described in detail below with reference to fig. 2.
Referring to fig. 2, a flowchart illustrating steps of a target IP address determining method provided in an embodiment of the present application is shown, and as shown in fig. 2, the target IP address determining method may include: step 201 and step 202.
Step 201: and acquiring the same IP address in the first IP address and the second IP address, and taking the same IP address as a target IP address.
In this embodiment, the DNS resolution information may include: the first IP address and DNS resolution time, and the AAA authentication information may include: broadband account number, second IP address, AAA authentication time and the like.
Of course, not limited thereto, the DNS resolution information may also include: requesting information such as the domain name of the query.
After extracting the DNS resolution information and the AAA authentication information of the target website, the same IP address information in the first IP address of the DNS resolution information and the second IP address of the AAA authentication information may be obtained, and the same IP address information may be used as the target IP address.
After the target IP address is acquired, step 202 is performed.
Step 202: and determining the broadband account number, DNS analysis time and AAA authentication time associated with the target IP address according to the DNS analysis information and AAA authentication information corresponding to the target IP address.
After the target IP address is obtained, the broadband account, the DNS resolution time, and the AAA authentication time associated with the target IP address may be determined according to the DNS resolution information and the AAA authentication information corresponding to the target IP address, that is, the DNS resolution time associated with the target IP address is obtained according to the DNS resolution information, and the broadband account and the AAA authentication time associated with the target IP address are obtained according to the AAA authentication information.
After determining the target IP address, the broadband account number associated with the target IP address, the DNS resolution time, and the AAA authentication time according to the DNS resolution information and the AAA authentication information, step 103 is performed.
Step 103: and grouping the DNS analysis time according to a set time length to generate a plurality of DNS analysis time groups, and acquiring the latest target DNS analysis time in each DNS analysis time group.
The set time length refers to a preset time length for grouping DNS resolution time every day, in this example, the set time length may be 30min, may also be 1h, and the like, specifically, the specific time length of the set time length may be determined according to a service requirement, which is not limited in this embodiment.
After the target IP address, the broadband account number associated with the target IP address, the DNS analysis time and the AAA authentication time are determined according to the DNS analysis information and the AAA authentication information, the DNS analysis time can be subjected to grouping processing according to the set time length to generate a plurality of DNS analysis time groups.
After the DNS resolution time is grouped according to the set duration to generate a plurality of DNS resolution time packets, the latest target DNS resolution time in each DNS resolution time packet may be obtained, for example, the obtained DNS resolution information and AAA authentication information in the current day are from 00: 00 to 12: the information in the 30 time period is set to have a duration of 1h, and the DNS resolution time in the DNS resolution information may be grouped according to 1h, such as 00: 00-01: DNS resolution time within 00 belongs to the first DNS resolution time packet, 01: 00-02: the DNS resolution time within 00 is subordinate to the second DNS resolution time packet. 00-12: the DNS resolution time in 30 is subordinate to the last DNS resolution time packet, etc., and the latest DNS resolution time in each DNS resolution time packet is the target DNS resolution time.
It should be understood that the above examples are only examples for better understanding of the technical solutions of the embodiments of the present application, and are not to be taken as the only limitation to the embodiments.
According to the embodiment of the application, the data information contained in the DNS analysis information and the AAA authentication information is grouped according to the set time length, so that the matching efficiency can be accelerated.
After the DNS resolution time is grouped according to the set duration to generate a plurality of DNS resolution time packets and the latest target DNS resolution time in each DNS resolution time packet is obtained, step 104 is executed.
Step 104: for each DNS resolution time packet, calculating a time difference between each DNS resolution time and the AAA authentication time.
After the DNS resolution times are grouped and the latest target DNS resolution time within each DNS resolution time packet is obtained, a time difference between each DNS resolution time within each DNS resolution time packet and the AAA authentication time may be calculated for each DNS resolution time packet.
In this embodiment, two-to-two matching is performed before calculating the time difference between the DNS resolution time and the AAA authentication time, and the time difference is calculated after obtaining the time matching list, which can be specifically described in detail below with reference to fig. 3.
Referring to fig. 3, a flowchart illustrating steps of a time difference calculation method provided in an embodiment of the present application is shown, and as shown in fig. 3, the time difference calculation method may include: step 301 and step 302.
Step 301: and for each DNS analysis time packet, matching every two DNS analysis times in the DNS analysis time packet with AAA authentication time to generate a time matching list.
In this embodiment, after performing packet processing on DNS resolution time according to a set duration to generate a plurality of DNS resolution time packets, for each DNS resolution time packet, pairwise matching between each DNS resolution time in the DNS resolution time packet and AAA authentication time may be performed to generate a time matching list, specifically, a many-to-many cross cartesian product grouping may be performed on each DNS resolution time in each DNS resolution time packet and AAA authentication time, and each DNS resolution time and paired AAA authentication time form one time matching list.
After pairwise matching each DNS resolution time within the DNS resolution time packet with the AAA authentication time for each DNS resolution time packet to generate a time matching list, step 302 is performed.
Step 302: and calculating the time difference between the DNS resolution time and the AAA authentication time in each time matching list.
After the time matching lists are generated, the difference between the DNS resolution time and the AAA authentication time in each time matching list can be calculated to obtain the time difference between the two times, i.e., the time distance.
In another specific implementation of the present application, after the time difference between each DNS resolution time and the AAA authentication time is calculated for each DNS resolution time packet, a time matching list in which the time difference is a negative value (that is, a time difference obtained by subtracting the AAA authentication time from the DNS resolution time is a negative value) may be filtered, that is, a time matching list in which the DNS resolution time is earlier than the AAA authentication time is filtered, so that invalid data may be filtered, and the speed of subsequently identifying a broadband account corresponding to the target IP address is increased.
After calculating the time difference between each DNS resolution time and the AAA authentication time for each DNS resolution time packet, step 105 is performed.
Step 105: and acquiring the target AAA authentication time with the closest time distance corresponding to the target DNS analysis time in each DNS analysis time packet according to the time difference.
After the time difference between each DNS resolution time packet and the AAA authentication time is calculated for each DNS resolution time packet, the target AAA authentication time closest to the target DNS resolution time corresponding to the target DNS resolution time in each DNS resolution time packet may be obtained according to the time difference, that is, the AAA authentication time having the smallest time difference with the target DNS resolution time is used as the target AAA authentication time. Specifically, the AAA authentication times may be sorted in advance according to a set time sequence to obtain an authentication time sorting result, for example, the AAA authentication times are sorted in an order from early to late, or the AAA authentication times are sorted in an order from late to early.
After the authentication time sorting is performed and the filtered time matching list is obtained, a target time list with the minimum time difference corresponding to the target DNS analysis time can be obtained, and the target AAA authentication time corresponding to the target IP address is determined according to the target time list.
After the target AAA authentication time closest in time distance corresponding to the target DNS resolution time in each DNS resolution time packet is obtained according to the time difference, step 106 is executed.
Step 106: and determining a target broadband account corresponding to the target IP address in the current day according to the AAA authentication information and the target AAA authentication time.
After the target AAA authentication time with the closest time distance corresponding to the target DNS resolution time in each DNS resolution time packet corresponding to the target IP address is obtained, the target broadband account corresponding to the target IP address in the current day may be determined according to the AAA authentication information and the target AAA authentication time, that is, the target broadband account corresponding to each DNS resolution time packet that is to be obtained is used as the target broadband account corresponding to the target IP address in the current day.
The above process can be described in detail in conjunction with fig. 4 as follows.
Referring to fig. 4, a schematic diagram illustrating that a batch of client IP addresses are identified as broadband users according to an embodiment of the present application is shown, and as shown in fig. 4, in user behavior analysis, key information of domain name DNS resolution of an access website is first extracted, where the key information includes a user IP address initiating a DNS request, a domain name requested to be queried, resolution time, and key information of AAA authentication, including a user internet account, a user IP address, and event reporting time. Grouping the IP to generate a plurality of corresponding broadband accounts, merging DNS analysis time by hours to obtain the latest analysis time, and sorting the AAA authentication time after standardized processing.
And performing many-to-many crossing Cartesian product matching on DNS analysis time and AAA authentication time to form a matching list, calculating the time distance between every two AAA servers, filtering the matching list with the AAA time being later than the DNS time, selecting the matching record with the closest time distance from all the matching lists with the AAA authentication time being earlier than the DNS analysis time, and identifying the broadband account as the corresponding IP account at the current time point.
The broadband account determination method provided by the embodiment of the application extracts the DNS analysis information and AAA authentication information of the target website in the current day, determining a target IP address, a broadband account number associated with the target IP address, DNS analysis time and AAA authentication time according to the DNS analysis information and the AAA authentication information, grouping the DNS analysis time according to a set time length to generate a plurality of DNS analysis time groups, and obtains the latest target DNS resolution time in each DNS resolution time packet, calculates the time difference between each DNS resolution time and AAA authentication time aiming at each DNS resolution time packet, according to the time difference, obtaining the target AAA authentication time with the closest time distance corresponding to the target DNS resolution time in each DNS resolution time packet, and determining the target broadband account corresponding to the target IP address in the current day according to the AAA authentication information and the target AAA authentication time. According to the embodiment of the application, the DNS analysis information and the AAA authentication information are subjected to data grouping according to the set duration, so that the matching efficiency can be improved, and the identification accuracy of the broadband account corresponding to the IP address can be improved by adopting a time difference matching and identifying mode.
Example two
Referring to fig. 5, which shows a schematic structural diagram of a broadband account determination apparatus provided in an embodiment of the present application, as shown in fig. 5, the broadband account determination apparatus 500 may include the following modules:
a DNS information extracting module 510, configured to extract DNS (Domain Name System) resolution information and AAA (Authentication, Authorization, and Accounting) Authentication information of a target website in the current day;
a target IP determining module 520, configured to determine a target IP address, and a broadband account, DNS resolution time, and AAA authentication time associated with the target IP address according to the DNS resolution information and the AAA authentication information;
a target DNS time obtaining module 530, configured to perform grouping processing on the DNS resolution time according to a set duration, generate a plurality of DNS resolution time groups, and obtain the latest target DNS resolution time in each DNS resolution time group;
a time difference calculation module 540, configured to calculate, for each DNS resolution time packet, a time difference between each DNS resolution time and the AAA authentication time;
a target authentication time obtaining module 550, configured to obtain, according to the time difference, a target AAA authentication time that is closest to a time distance corresponding to the target DNS resolution time in each DNS resolution time packet;
and a target broadband account determining module 560, configured to determine, according to the AAA authentication information and the target AAA authentication time, a target broadband account corresponding to the target IP address in the current day.
Optionally, the DNS resolution information includes: the first IP address and DNS resolution time, and the AAA authentication information comprises: the second IP address and the AAA authentication time,
the target IP determining module comprises:
a target IP obtaining unit, configured to obtain a same IP address of the first IP address and the second IP address, and use the same IP address as a target IP address;
and the broadband account determining unit is used for determining the broadband account, DNS analysis time and AAA authentication time associated with the target IP address according to the DNS analysis information and the AAA authentication information corresponding to the target IP address.
Optionally, the time difference calculating module includes:
a time matching list generating unit, configured to match, for each DNS resolution time packet, every DNS resolution time and AAA authentication time in the DNS resolution time packet to generate a time matching list;
and the time difference calculating unit is used for calculating and obtaining the time difference between the DNS analysis time and the AAA authentication time in each time matching list.
Optionally, the apparatus further comprises:
and the time matching list filtering module is used for filtering the time matching list with the time difference being a negative value in the time matching list.
Optionally, the apparatus further comprises:
the authentication time sequencing result acquisition module is used for sequencing the AAA authentication time according to a set time sequence to obtain an authentication time sequencing result;
the target authentication time acquisition module includes:
a target time list obtaining unit, configured to obtain a target time list with a minimum time difference corresponding to the target DNS resolution time in the filtered time matching list;
and the target authentication time determining unit is used for determining the target AAA authentication time according to the target time list.
The broadband account determination device provided by the embodiment of the application extracts the DNS analysis information and AAA authentication information of the target website in the current day, determining a target IP address, a broadband account number associated with the target IP address, DNS analysis time and AAA authentication time according to the DNS analysis information and the AAA authentication information, grouping the DNS analysis time according to a set time length to generate a plurality of DNS analysis time groups, and obtains the latest target DNS resolution time in each DNS resolution time packet, calculates the time difference between each DNS resolution time and AAA authentication time aiming at each DNS resolution time packet, according to the time difference, obtaining the target AAA authentication time with the closest time distance corresponding to the target DNS analysis time in each DNS analysis time packet, and determining the target broadband account corresponding to the target IP address in the current day according to the AAA authentication information and the target AAA authentication time. According to the embodiment of the application, the DNS analysis information and the AAA authentication information are subjected to data grouping according to the set duration, so that the matching efficiency can be improved, and the identification accuracy of the broadband account corresponding to the IP address can be improved by adopting a time difference matching and identifying mode.
EXAMPLE III
Referring to fig. 6, a schematic structural diagram of an electronic device provided in an embodiment of the present application is shown. As shown in fig. 6, the electronic device 600 may be provided as a server. Referring to fig. 6, electronic device 600 includes a processing component 622 that further includes one or more processors and memory resources, represented by memory 632, for storing instructions, such as applications, that are executable by processing component 622. The application programs stored in memory 632 may include one or more modules that each correspond to a set of instructions. Further, the processing component 622 is configured to execute instructions to perform the following method:
extracting DNS (Domain Name System) resolution information and AAA (Authentication, Authorization and Accounting) Authentication information of a target website in the current day;
determining a target IP address, a broadband account number associated with the target IP address, DNS analysis time and AAA authentication time according to the DNS analysis information and the AAA authentication information;
grouping the DNS analysis time according to a set time length to generate a plurality of DNS analysis time groups, and acquiring the latest target DNS analysis time in each DNS analysis time group;
calculating a time difference between each DNS resolution time and the AAA authentication time for each DNS resolution time packet;
according to the time difference, acquiring target AAA authentication time with the closest time distance corresponding to the target DNS analysis time in each DNS analysis time packet;
and determining a target broadband account corresponding to the target IP address in the current day according to the AAA authentication information and the target AAA authentication time.
Optionally, the DNS resolution information includes: the first IP address and DNS resolution time, and the AAA authentication information comprises: the second IP address and the AAA authentication time,
the determining a target IP address, a broadband account number associated with the target IP address, DNS analysis time and AAA authentication time according to the DNS analysis information and the AAA authentication information comprises the following steps:
acquiring the same IP address in the first IP address and the second IP address, and taking the same IP address as a target IP address;
and determining the broadband account number, DNS analysis time and AAA authentication time associated with the target IP address according to the DNS analysis information and AAA authentication information corresponding to the target IP address.
Optionally, said calculating, for each DNS resolution time packet, a time difference between each DNS resolution time and the AAA authentication time comprises:
for each DNS analysis time packet, matching every two DNS analysis times in the DNS analysis time packet with AAA authentication time to generate a time matching list;
and calculating the time difference between the DNS resolution time and the AAA authentication time in each time matching list.
Optionally, after the calculating a time difference between the DNS resolution time and the AAA authentication time in each of the time matching lists, the method further includes:
and filtering out the time matching lists with the time difference being a negative value.
Optionally, before obtaining, according to the time difference, a target AAA authentication time whose time distance corresponding to the target DNS resolution time in each DNS resolution time packet is closest to the target DNS resolution time, the method further includes:
sequencing the AAA authentication time according to a set time sequence to obtain an authentication time sequencing result;
the obtaining the target AAA authentication time with the closest time distance corresponding to the target DNS analysis time in each DNS analysis time packet according to the time difference comprises the following steps:
acquiring a target time list with the minimum time difference corresponding to the target DNS analysis time in the filtered time matching list;
and determining the target AAA authentication time according to the target time list.
Additionally, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored, where the computer program, when executed by a processor, implements the above-mentioned broadband account determination method.
The embodiments in the present specification are described in a progressive manner, each embodiment focuses on differences from other embodiments, and the same and similar parts among the embodiments are referred to each other.
As will be appreciated by one of skill in the art, embodiments of the present application may be provided as a method, apparatus, or computer program product. Accordingly, embodiments of the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, embodiments of the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
Embodiments of the present application are described with reference to flowchart illustrations and/or block diagrams of methods, terminals (systems), and computer program products according to embodiments of the application. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing terminal to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing terminal to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
While preferred embodiments of the present application have been described, additional variations and modifications of these embodiments may occur to those skilled in the art once they learn of the basic inventive concepts. Therefore, it is intended that the appended claims be interpreted as including the preferred embodiment and all such alterations and modifications as fall within the true scope of the embodiments of the application.
Finally, it should also be noted that, herein, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or terminal that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or terminal. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other like elements in a process, method, article, or terminal that comprises the element.
The broadband account determining method, the broadband account determining device, the electronic device and the computer-readable storage medium provided by the present application are described in detail above, and specific examples are applied in the present application to explain the principles and embodiments of the present application, and the descriptions of the above embodiments are only used to help understand the method and the core ideas of the present application; meanwhile, for a person skilled in the art, according to the idea of the present application, there may be variations in the specific embodiments and the application scope, and in summary, the content of the present specification should not be construed as a limitation to the present application.

Claims (12)

1. A broadband account number determination method is characterized by comprising the following steps:
extracting DNS (Domain Name System) resolution information and AAA (Authentication, Authorization and Accounting) Authentication information of a target website in the current day;
determining a target IP address, a broadband account number associated with the target IP address, DNS analysis time and AAA authentication time according to the DNS analysis information and the AAA authentication information;
grouping the DNS analysis time according to a set time length to generate a plurality of DNS analysis time groups, and acquiring the latest target DNS analysis time in each DNS analysis time group;
calculating a time difference between each DNS resolution time and the AAA authentication time for each DNS resolution time packet;
according to the time difference, acquiring target AAA authentication time with the closest time distance corresponding to the target DNS analysis time in each DNS analysis time packet;
and determining a target broadband account corresponding to the target IP address in the current day according to the AAA authentication information and the target AAA authentication time.
2. The method of claim 1, wherein the DNS resolution information comprises: the first IP address and DNS resolution time, and the AAA authentication information comprises: the second IP address and the AAA authentication time,
the determining a target IP address, a broadband account number associated with the target IP address, DNS analysis time and AAA authentication time according to the DNS analysis information and the AAA authentication information comprises the following steps:
acquiring the same IP address in the first IP address and the second IP address, and taking the same IP address as a target IP address;
and determining the broadband account number, DNS analysis time and AAA authentication time associated with the target IP address according to the DNS analysis information and AAA authentication information corresponding to the target IP address.
3. The method of claim 1, wherein calculating, for each DNS resolution time packet, a time difference between each DNS resolution time and the AAA authentication time comprises:
for each DNS analysis time packet, matching every two DNS analysis times in the DNS analysis time packet with AAA authentication time to generate a time matching list;
and calculating the time difference between the DNS resolution time and the AAA authentication time in each time matching list.
4. The method of claim 3, wherein after the calculating a time difference between the DNS resolution time and the AAA authentication time in each of the time matching lists, further comprising:
and filtering out the time matching lists with the time difference being a negative value.
5. The method according to claim 4, wherein before said obtaining, according to the time difference, a target AAA authentication time with a closest time distance corresponding to the target DNS resolution time in each DNS resolution time packet, further comprising:
sequencing the AAA authentication time according to a set time sequence to obtain an authentication time sequencing result;
the obtaining the target AAA authentication time with the closest time distance corresponding to the target DNS analysis time in each DNS analysis time packet according to the time difference comprises the following steps:
acquiring a target time list with the minimum time difference corresponding to the target DNS analysis time in the filtered time matching list;
and determining the target AAA authentication time according to the target time list.
6. A broadband account determination apparatus, comprising:
a DNS information extraction module, configured to extract DNS (Domain Name System) resolution information and AAA (Authentication, Authorization, and Accounting) Authentication information of a target website in the current day;
a target IP determining module, configured to determine a target IP address, and a broadband account, DNS resolution time, and AAA authentication time associated with the target IP address according to the DNS resolution information and the AAA authentication information;
the target DNS time acquisition module is used for grouping the DNS analysis time according to set time length to generate a plurality of DNS analysis time groups and acquiring the latest target DNS analysis time in each DNS analysis time group;
a time difference calculation module for calculating a time difference between each DNS resolution time and the AAA authentication time for each DNS resolution time packet;
a target authentication time acquisition module, configured to acquire, according to the time difference, a target AAA authentication time that is closest to a time distance corresponding to the target DNS resolution time in each DNS resolution time packet;
and the target broadband account determining module is used for determining a target broadband account corresponding to the target IP address in the current day according to the AAA authentication information and the target AAA authentication time.
7. The apparatus of claim 6, wherein the DNS resolution information comprises: the first IP address and the DNS resolution time, and the AAA authentication information includes: the second IP address and the AAA authentication time,
the target IP determining module comprises:
a target IP obtaining unit, configured to obtain a same IP address from the first IP address and the second IP address, and use the same IP address as a target IP address;
and the broadband account determining unit is used for determining the broadband account, DNS analysis time and AAA authentication time associated with the target IP address according to the DNS analysis information and the AAA authentication information corresponding to the target IP address.
8. The apparatus of claim 6, wherein the time difference calculation module comprises:
a time matching list generating unit, configured to match, for each DNS resolution time packet, every DNS resolution time and AAA authentication time in the DNS resolution time packet to generate a time matching list;
and the time difference calculating unit is used for calculating and obtaining the time difference between the DNS analysis time and the AAA authentication time in each time matching list.
9. The apparatus of claim 8, further comprising:
and the time matching list filtering module is used for filtering the time matching list with the time difference being a negative value in the time matching list.
10. The apparatus of claim 9, further comprising:
the authentication time sequencing result acquisition module is used for sequencing the AAA authentication time according to a set time sequence to obtain an authentication time sequencing result;
the target authentication time acquisition module includes:
a target time list obtaining unit, configured to obtain a target time list with a minimum time difference corresponding to the target DNS resolution time in the filtered time matching list;
and the target authentication time determining unit is used for determining the target AAA authentication time according to the target time list.
11. An electronic device, comprising:
a processor, a memory, and a computer program stored on the memory and executable on the processor, the processor implementing the broadband account number determination method of any one of claims 1 to 5 when executing the program.
12. A computer-readable storage medium, wherein instructions in the storage medium, when executed by a processor of an electronic device, enable the electronic device to perform the broadband account determination method of any one of claims 1 to 5.
CN202210504688.1A 2022-05-10 2022-05-10 Broadband account number determination method and device Pending CN115021969A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202210504688.1A CN115021969A (en) 2022-05-10 2022-05-10 Broadband account number determination method and device

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202210504688.1A CN115021969A (en) 2022-05-10 2022-05-10 Broadband account number determination method and device

Publications (1)

Publication Number Publication Date
CN115021969A true CN115021969A (en) 2022-09-06

Family

ID=83069390

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202210504688.1A Pending CN115021969A (en) 2022-05-10 2022-05-10 Broadband account number determination method and device

Country Status (1)

Country Link
CN (1) CN115021969A (en)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102932492A (en) * 2011-09-12 2013-02-13 微软公司 Correlation of users to ip address lease events
US20190180020A1 (en) * 2019-01-28 2019-06-13 Joseph Carlo Pastrana Computerized User Authentication Method that Utilizes the Cartesian Coordinate System to Verify a User's Identity
CN111200665A (en) * 2018-11-19 2020-05-26 中国移动通信集团吉林有限公司 User source tracing method and device and computer readable storage medium
CN111241502A (en) * 2020-01-14 2020-06-05 恩亿科(北京)数据科技有限公司 Cross-device user identification method and device, electronic device and storage medium
US20220060469A1 (en) * 2020-08-18 2022-02-24 Capital One Services, Llc Computer-based systems involving sharing session authentication and/or account details with a trusted party and methods of use thereof

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102932492A (en) * 2011-09-12 2013-02-13 微软公司 Correlation of users to ip address lease events
CN111200665A (en) * 2018-11-19 2020-05-26 中国移动通信集团吉林有限公司 User source tracing method and device and computer readable storage medium
US20190180020A1 (en) * 2019-01-28 2019-06-13 Joseph Carlo Pastrana Computerized User Authentication Method that Utilizes the Cartesian Coordinate System to Verify a User's Identity
CN111241502A (en) * 2020-01-14 2020-06-05 恩亿科(北京)数据科技有限公司 Cross-device user identification method and device, electronic device and storage medium
US20220060469A1 (en) * 2020-08-18 2022-02-24 Capital One Services, Llc Computer-based systems involving sharing session authentication and/or account details with a trusted party and methods of use thereof

Similar Documents

Publication Publication Date Title
CN107347052B (en) Method and device for detecting database collision attack
CN106776901B (en) Data extraction method, device and system
CN105025025A (en) Cloud-platform-based domain name active detecting method and system
US20120254398A1 (en) Traffic Like NXDomains
CN110611684A (en) Method, system and storage medium for detecting periodic Web access behavior
CN109474691B (en) Method and device for identifying equipment of Internet of things
CN108446170B (en) DNS thread management method and device based on machine learning and server
CN112118249A (en) Security protection method and device based on log and firewall
CN110648172A (en) Identity recognition method and system fusing multiple mobile devices
CN106961441B (en) User dynamic access control method for Hadoop cloud platform
CN107786529B (en) Website detection method, device and system
CN107688563B (en) Synonym recognition method and recognition device
CN111090669A (en) Data query method and device based on space-time collision
CN115021969A (en) Broadband account number determination method and device
CN109284833B (en) Method, apparatus and storage medium for obtaining feature data for machine learning model
CN115374109B (en) Data access method, device, computing equipment and system
CN109688236B (en) Sinkhole domain name processing method and server
CN115794780A (en) Method and device for collecting network space assets, electronic equipment and storage medium
KR100902757B1 (en) Method and system for providing searching result based on url
US10091311B2 (en) Smart location determination
CN111800409B (en) Interface attack detection method and device
CN114154087A (en) Time blind comment detection method, device, equipment and readable storage medium
CN114090336A (en) Data backup method and device
CN111611483A (en) Object portrait construction method, device, equipment and storage medium
Huidrom et al. Clustering techniques for the identification of web user session

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination