CN115967746A - Domain name cache replacement method and system based on time window - Google Patents

Abstract

The invention relates to a domain name cache replacement method and system based on a time window. The method comprises the steps of receiving a query request of a domain name in real time by responding to a DNS (domain name system), and classifying the received domain name into a disposable domain name or a non-disposable domain name by adopting a domain name classifier; if the received domain name is a non-disposable domain name, the current domain name directly enters the hierarchical cache processing; if the received domain name is a disposable domain name, the current domain name is processed in advance through a time window and then enters a hierarchical cache. Compared with the prior art, the invention has the following remarkable advantages: the method for judging the disposable domain name by adding the time window on the basis of the domain name characteristics is adopted, the problem that the existing domain name classification method is easy to misjudge is solved, negative effects caused by discarding the non-disposable domain name are avoided, and the accuracy of domain name identification is improved.

Description

A method and system for replacing domain name cache based on time window

technical field

The invention relates to the field of Internet information technology, in particular to a time window-based domain name cache replacement method and system.

Background technique

With the development of Internet technology, DNS is often used as an effective channel for communication between services in addition to the normal function of resolving domain names to IP; For temporary use, i.e. with a "one-shot" usage pattern and very high volume domain names. Its main feature is that the DNS cache is filled with entries with a hit rate close to zero, and domain names accessed many times are replaced out of the cache in advance. Therefore, this one-time domain name reduces the cache hit rate, causing problems such as increased forwarding traffic and increased server load.

At the same time, with the complexity of domain name request behavior and name features, the existing one-time domain name identification methods are facing the problem of decreased accuracy. In some scenarios, such as domain name requests related to download activities on a cloud platform, such requests With the same area, the domain name structure under this area is exactly the same, with the same depth, and the number of requests is huge. Although this type of domain name has the characteristics of a one-time domain name, it needs to be accessed again. If it is not saved, it will cause a certain cache loss. distinguish. At the same time, the existing methods for the identification of one-time domain names, whether based on the analysis of name features, semantic features, or name structures, cannot guarantee complete and accurate identification, and there are still some special cases in one-time domain names, resulting in a decrease in the cache hit rate , which in turn affects the traffic load and user query delay between the recursive server and the remote server.

Document 1: Chinese published invention patent CN202111452686.4 claims to protect a domain name screening method, system, device, and computer-readable storage medium. It is often used to ensure that the obtained domain names are highly probable by reducing the amount of data, but its function is to use The DNS resolution log removes the abnormal domain name from the obtained domain name to obtain a valid domain name; it cannot solve the problem of one-time domain name identification and processing.

Contents of the invention

The purpose of the present invention is to provide a domain name cache replacement method and system based on time windows, construct a domain name classifier according to the method of extracting name features, use time windows to increase time features to perform secondary identification of domain names, combined with the domain name cache replacement function, only Resource records identified as non-disposable domain names are placed in the cache to effectively remove disposable domain names.

The technical solution that realizes the object of the present invention is:

A method for replacing a domain name cache based on a time window, characterized in that: the method includes:

Respond to the query request of the DNS to receive domain names in real time, and use the domain name classifier to classify the received domain names as one-time domain names or non-disposable domain names;

If the received domain name is a non-disposable domain name, the current domain name will directly enter the hierarchical cache processing; if the received domain name is a one-time domain name, the current domain name will be processed in a time window before entering the hierarchical cache processing.

Further, the query request of the domain name forms a corresponding resource record in the DNS, wherein, the one-time domain name means that there is a domain name with a corresponding resource record in the DNS, and the non-one-time domain name means that there is a domain name with a corresponding resource record in the DNS more than once .

Further, the time window processing is:

Within the preset time period, when the number of queries of the current domain name reaches the threshold, the resource records of the current domain name are cached hierarchically;

If the number of queries of the current domain name does not reach the threshold, discard the resource record of the current domain name, and return to continue to respond to the query request of DNS to receive the domain name in real time;

Wherein, the query times of the current domain name are obtained through accumulation, including the query times of external clients and the occurrence times of the same domain name sent by the domain name classifier.

Further, hierarchical caching includes low-level caching and high-level caching, and the specific processing steps are:

Determine whether the resource records of the current domain name are stored for the first time, and if so, put the resource records of the current domain name into the low-level cache; otherwise, put the resource records of the current domain name into the high-level cache, and accumulate the resource records of the current domain name number of caches;

When the high-level cache is full, accumulate the resource record cache times of all cached domain names, and downgrade the domain name with the least cache times to the low-level cache; when the low-level cache is full, accumulate the resource record cache times of all cached domain names , and remove the domain with the least number of caches.

The present invention also provides a domain name cache replacement system based on time windows, including a domain name classification unit, a time window processing unit and a hierarchical cache unit, wherein:

The domain name classification unit is used to obtain the domain name query request received by the DNS, classify the domain name according to the name feature classification method, and send the classification result to the time window processing unit;

A time window processing unit, configured to record the number of queries of domain names within a preset time period based on classification results;

The hierarchical caching unit is configured to receive domain names satisfying the caching threshold condition for hierarchical caching processing, and remove the domain name with the least number of caching times.

Further, the domain name query request forms a corresponding resource record in the DNS, and the classification result is counting the number of times the domain name has a corresponding resource record in the DNS.

Further, the time window processing unit includes several sliding time windows, and several sliding time windows are set with different time ranges and query thresholds. Each sliding time window has a built-in expired cache library, and the expired cache library has an expired automatic refresh attribute An ordered dictionary of .

Further, the specific processing flow of the time window processing unit is:

Select any sliding time window, and judge whether the number of domain name queries reaches the query threshold within the time range of the sliding time window; if so, store the resource records of the domain name in the hierarchical cache unit, otherwise, discard the domain name;

Wherein, the number of queries of the domain name is accumulated, including the number of queries of external clients and the number of occurrences of the same domain name in the analysis results sent by the domain name classification unit.

Further, the hierarchical cache unit includes a low-level cache area and a high-level cache area, and the specific operation steps are:

Determine whether the resource record of the domain name is stored for the first time, if so, put the resource record of the domain name into the low-level cache; otherwise, put the resource record of the domain name into the high-level cache, and accumulate the cache times of the resource record of the domain name ;

The LRU algorithm is used to statistically sort the cache times of all stored domain names. When the high-level cache area is full, the domain name with the least cache times will be downgraded and moved to the low-level cache area; when the low-level cache area is full, the cache times will be reduced. Minimal domain names are removed directly.

Compared with the prior art, the present invention has the remarkable advantage that it adopts the method of judging one-time domain name by adding time window on the basis of domain name characteristics, which solves the problem that the existing domain name classification method is easy to misjudgment, and avoids discarding non-one-time domain names. negative impact caused by generic domain names, and improve the accuracy of domain name recognition. At the same time, through hierarchical caching of the domain names processed by the time window, domain names with less query times are eliminated in time, reducing the load on the server and reducing user query delays.

Description of drawings

FIG. 1 is a schematic structural diagram of a domain name cache replacement system based on time windows according to the present invention.

Detailed ways

Embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings.

A method for replacing a domain name cache based on a time window, characterized in that: the method includes:

Respond to the query request of the DNS to receive domain names in real time, and use the domain name classifier to classify the received domain names as one-time domain names or non-disposable domain names;

If the received domain name is a non-disposable domain name, the current domain name will directly enter the hierarchical cache processing; if the received domain name is a one-time domain name, the current domain name will be processed in a time window before entering the hierarchical cache processing.

Specifically, a query request for a domain name forms a corresponding resource record in the DNS, where a one-time domain name means a domain name with a corresponding resource record in the DNS once, and a non-disposable domain name means a domain name with a corresponding resource record in the DNS more than once .

Among them, the corresponding resource records of the domain name in the DNS include:

A record: indicates the host record, which is the mapping from DNS name to IP address, and is used for forward resolution;

CNAME record: indicates the alias record, which is used to define the alias of the A record;

MX record (mail exchange): indicates the mail exchange record, which is used to tell the mail server process to send the mail to another designated mail server;

NS record: DNS server used to identify the zone. There may be multiple ns records in one zone, such as a primary server and multiple secondary servers;

PTR record: used for reverse resolution, which is the mapping from IP address to DNS name;

SOA record: It is used for the beginning of an area. All information after the SOA record is used to control this area. Each area database file must contain an SOA record, and it must be the first resource record in it for Identify the starting position of DNS server management, and the SOA record can resolve which of the DNS servers in this area is the primary server.

Specifically, the time window processing is as follows:

Within the preset time period, when the number of queries of the current domain name reaches the threshold, the resource records of the current domain name are cached hierarchically;

If the number of queries of the current domain name does not reach the threshold, discard the resource record of the current domain name, and return to continue to respond to the query request of DNS to receive the domain name in real time;

Wherein, the query times of the current domain name are obtained through accumulation, including the query times of external clients and the occurrence times of the same domain name sent by the domain name classifier.

Specifically, hierarchical caching includes low-level caching and high-level caching, and the processing steps are:

Determine whether the resource records of the current domain name are stored for the first time, and if so, put the resource records of the current domain name into the low-level cache; otherwise, put the resource records of the current domain name into the high-level cache, and accumulate the resource records of the current domain name number of caches;

When the high-level cache is full, accumulate the resource record cache times of all cached domain names, and downgrade the domain name with the least cache times to the low-level cache; when the low-level cache is full, accumulate the resource record cache times of all cached domain names , and remove the domain with the least number of caches.

As shown in Figure 1, the present invention also provides a domain name cache replacement system based on time windows, including a domain name classification unit, a time window processing unit, and a hierarchical cache unit, wherein:

The domain name classification unit is used to obtain the domain name query request received by the DNS, classify the domain name according to the name feature classification method, and send the classification result to the time window processing unit;

A time window processing unit, configured to record the number of queries of domain names within a preset time period based on classification results;

The hierarchical caching unit is configured to receive domain names satisfying the caching threshold condition for hierarchical caching processing, and remove the domain name with the least number of caching times.

Specifically, the domain name query request forms a corresponding resource record in the DNS, and the classification result is to count the number of times the domain name has a corresponding resource record in the DNS, including:

A domain name that has a corresponding resource record in the DNS and has only one resource record is classified as a one-time domain name;

A domain name that has a corresponding resource record in the DNS and the resource record is more than once is classified as a non-disposable domain name.

Specifically, the time window processing unit includes several sliding time windows, and several sliding time windows are set with different time ranges and query thresholds. Each sliding time window has a built-in expired cache library, and the expired cache library has an expired automatic refresh attribute. An ordered dictionary of .

Specifically, the specific processing flow of the time window processing unit is:

Select any sliding time window, and judge whether the number of domain name queries reaches the query threshold within the time range of the sliding time window; if so, store the resource records of the domain name in the hierarchical cache unit, otherwise, discard the domain name;

Wherein, the number of queries of the domain name is accumulated, including the number of queries of external clients and the number of occurrences of the same domain name in the analysis results sent by the domain name classification unit.

Specifically, the hierarchical cache unit includes a low-level cache area and a high-level cache area, and the specific operation steps are:

Determine whether the resource record of the domain name is stored for the first time, if so, put the resource record of the domain name into the low-level cache; otherwise, put the resource record of the domain name into the high-level cache, and accumulate the cache times of the resource record of the domain name ;

The LRU algorithm is used to statistically sort the cache times of all stored domain names. When the high-level cache area is full, the domain names with the least cache times will be downgraded and moved to the low-level cache area; when the low-level cache area is full, the domain names with the least cache times will be moved. The domain name is removed directly.

Specific examples are as follows:

S1. The local recursive server receives a query request of the domain name replied by DNS from the remote server;

S2. Use the domain name classifier to classify the domain name; the processing of the classification result is: if it is identified as a non-primary domain name, it will be directly placed in the hierarchical cache, otherwise it will be sent to the time window processor for further processing;

S3. The time window processor makes judgments according to the preset time and threshold, for example: set the number of queries within 100 seconds to 3 times, that is, if the domain name is requested more than 3 times within 100 seconds, the resource record corresponding to the domain name will be recorded Put it into the hierarchical cache, otherwise discard it; continue to receive the query request of the next domain name;

S4. Determine whether there is a resource record corresponding to the domain name in the cache, and if so, directly return the query result; otherwise, continue to query downwards, and return to S1 for loop execution.

The time window processing steps in step S3 are specifically:

S31. Setting different sliding time windows and different thresholds to test the cache hit rate;

S32. Evaluate the hit rate and occupied storage space;

S33. Select the time window and threshold according to the actual situation, in this scheme, select 100 seconds for 3 times;

S34. The time window processor records the number of records in the time window. The time window processor has a built-in ExpiringDict (expiring dictionary). ExpiringDict is an ordered dictionary with an expired automatic refresh attribute. The sliding time can be recorded by setting the automatic expiration value The number of domain name requests within the window.

S35. Perform logical processing according to the records of ExpiringDict, that is, put resource records corresponding to domain names whose request times exceed 3 times within 100 seconds into the hierarchical cache and return a response result.

In step S35, the specific processing operation of putting into hierarchical cache is as follows:

S351. When a new resource record is cached, put it into the low-level cache first;

S352, when it hits again, it is upgraded to the advanced cache;

S353. When the low-level cache is full, directly remove the least recently used resource record according to the LRU (Least Recently Used) algorithm.

S354. When the high-level cache is full, demote the least recently used resource record to the low-level cache according to the LRU algorithm.

The above-mentioned embodiments only represent several implementation modes of the present application, and the description thereof is relatively specific and detailed, but it should not be construed as limiting the scope of the patent for the invention. It should be noted that those skilled in the art can make several modifications and improvements without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the scope of protection of the patent application should be based on the appended claims.

Claims (9)

1. A domain name cache replacing method based on a time window is characterized in that: the method comprises the following steps:

responding to a query request of a DNS (domain name server) for receiving a domain name in real time, and classifying the received domain name into a disposable domain name or a non-disposable domain name through a domain name classifier;

if the received domain name is a non-disposable domain name, the current domain name directly enters the hierarchical cache processing; if the received domain name is a disposable domain name, the current domain name is processed in a time window mode in advance and then enters a hierarchical cache mode.

2. The method according to claim 1, wherein the method for replacing the domain name cache based on the time window comprises the following steps: the query request of the domain name forms a corresponding resource record in the DNS, wherein:

the disposable domain name indicates that the corresponding resource record exists in the DNS as a domain name for one time, and the non-disposable domain name indicates that the corresponding resource record exists in the DNS for more than one time.

3. The domain name cache replacement method based on the time window according to claim 1, characterized in that: the time window processing is as follows:

in a preset time period, when the query frequency of the current domain reaches a threshold value, performing hierarchical cache processing on the resource record of the current domain;

if the query frequency of the current domain name does not reach the threshold value, discarding the resource record of the current domain name, and returning to continuously respond to the DNS to receive the query request of the domain name in real time;

the current query times of the domain name are obtained through accumulation, and include the query times of an external client and the occurrence times of the same domain name sent by the domain name classifier.

4. The domain name cache replacement method based on the time window according to claim 1, characterized in that: the hierarchical cache comprises a low-level cache and a high-level cache, and the specific processing steps are as follows:

judging whether the resource record of the current domain name is stored for the first time, if so, putting the resource record of the current domain name into a low-level cache; otherwise, the resource record of the current domain name is put into a high-level cache, and the caching times of the resource record of the current domain name are accumulated;

when the high-level cache is filled up, accumulating the resource record caching times of all cached domain names, and downgrading and storing the domain name with the least caching times into the low-level cache; when the lower level cache is full, the resource record cache times for all cached domain names are accumulated, and the domain name with the least cache times is removed.

5. A domain name cache replacement system based on time window is characterized in that: the domain name classification unit, the time window processing unit and the hierarchical cache unit are included, wherein:

the domain name classification unit is used for acquiring a domain name query request received by the DNS, classifying the domain name according to a name feature classification method, and sending a classification result to the time window processing unit;

the time window processing unit is used for recording the query times of the domain name in a preset time period based on the classification result;

and the hierarchical cache unit is used for receiving the domain names meeting the cache threshold condition, performing hierarchical cache processing, and removing the domain name with the least cache times.

6. The system according to claim 5, wherein the system comprises: and the query request of the domain name forms a corresponding resource record in the DNS, and the classification result is the frequency of counting the existence of the corresponding resource record of the domain name in the DNS.

7. The system according to claim 5, wherein the system comprises: the time window processing unit comprises a plurality of sliding time windows, the sliding time windows are provided with different time ranges and query thresholds, an overdue cache bank is arranged in each sliding time window, and each overdue cache bank is an ordered dictionary with an overdue automatic refresh attribute.

8. The system according to claim 7, wherein the system further comprises: the specific processing flow of the time window processing unit is as follows:

selecting any one sliding time window, and judging whether the query frequency of the domain name reaches a query threshold value within the time range of the sliding time window; if yes, storing the resource record of the domain name to the hierarchical cache unit, otherwise, discarding the domain name;

the query times of the domain name are obtained through accumulation, and include the query times of an external client and the times of occurrence of the same domain name in an analysis result sent by the domain name classification unit.

9. The system according to claim 8, wherein the system further comprises: the hierarchical cache unit comprises a low-level cache region and a high-level cache region, and the specific operation steps are as follows:

judging whether the resource record of the domain name is stored for the first time, if so, putting the resource record of the domain name into a low-level cache region; otherwise, the resource records of the domain name are put into a high-level cache region, and the caching times of the resource records of the domain name are accumulated;

performing statistical sorting on the caching times of all the stored domain names by adopting an LRU algorithm, and when a high-level cache region is filled, performing degradation and transfer on the domain name with the minimum caching times to a low-level cache region; and when the lower-level cache region is filled, directly removing the domain name with the least caching times.

Images