基于权威域名服务器的停靠域名识别机制

Mechanism of parked domain recognition based on authoritative domain name servers

由于互联网中充斥着大量的停靠域名,给用户上网体验、上网环境带来严重影响,为识别停靠域名,提出一种基于权威域名服务器(DNS)的停靠域名检测方法。该方法从常用于域名停靠服务的错拼域名入手,提取出可能用于停靠服务的权威DNS集合,并通过半监督聚类方法对该集合进行分析,识别出用于停靠服务的权威DNS。在检测停靠域名时,通过判断域名的权威DNS是否用于停靠服务,并且该域名解析的IP地址是否属于停靠服务Web服务器的IP地址集合,来对停靠域名进行识别。借助现有基于页面特征的检测方法对所提方法进行分析,实验结果表明所提方法的准确率达92.8%以上,并且避免了页面信息的爬取,能够实时地检测域名是否为停靠域名。

The massive parked domains exist in the Internet, which seriously affect the Internet experience and Internet environment of online users when surfing. In order to recognize parked domains, a new method of parked domain recognition was proposed based on authoritative Domain Name Server （ DNS）. The set of authoritative DNS which could be used for domain parking service was extracted by the typosquatting domains commonly used in domain parking service. Then the set was clustered by semi-supervised clustering method to identify the authoritative DNS associated with domain parking service. When detecting a parked domain, the parked domain was recognized by the judgments that whether its authoritative DNS was applied in domain parking service and whether its mapped IP addresses was concluded in the set of IP addresses of parking Web servers. By using the existing detecting method based on webpages＇ features, the accuracy of the proposed method was analyzed. The experimental results show the proposed method has achieved the accuracy rate of 92.8%, and avoids crawling the webpage information, which has a good performance on parked domains detection in real-time.