Summary of the invention
For defect of the prior art, the invention provides and a kind of can reduce what domain name was analyzed
The methods of exhibiting of workload.
First aspect, the invention provides a kind of exhibiting device analyzed for domain name, including:
First, first display module, for showing that showing one in interface is used for representing to be analyzed
The indications of the network address, the described network address is domain name addresses or IP address;
Second display module, for receiving the forward for a selected indications input
During query statement, obtain the network address corresponding to this selected indications in the selected time period
First, each network address being inside resolved to, shows that in interface, displaying is used for representing each
The indications of the network address got;
3rd display module, for reverse receive for the input of selected indications
During query statement, in the time period selected by acquisition, it is resolved to the net that this selected indications is corresponding
First, each network address of network address, shows that in interface, displaying is used for representing that each obtains
The indications of the network address arrived.
Optionally, this device also includes:
4th display module, for by net corresponding to selected indications or whole indications
Network address is shown.
Optionally, this device also includes:
5th display module is corresponding for the indications obtaining this selected at the second display module
Each network address and/or the 3rd display module that the network address is resolved to obtain and are resolved to this
After each network address of the network address that selected indications is corresponding, show interface first
Middle by indications use line corresponding with each network address got for this selected indications
Bar connects.
Optionally, described 5th display module is specifically for the network ground got according to each
One form of parsing type selecting corresponding to location resolves the corresponding lines of type by this choosing with it
The fixed indications indications corresponding with this network address is connected, and the different types that resolve are not corresponding to
Lines with form;
Wherein, described parsing type is with at least one Types Below: IPv4 address record, another name
Record, name server record, initial authority's record, pointer record, e-mail intersection record,
Text entry, IPv6 address record, positioning service record, represent title record, entrust sign and issue
Person's record.
Optionally, described second display module is for obtaining the network that this selected indications is corresponding
Each network address that address was resolved within the described time period and be resolved to each and obtain
The number of times of the network address got and parsing time;According to each network address corresponding time
Count the corresponding indications of one corresponding number of times of size of selection and show;There are different times
The indications corresponding to the network address of number has different sizes;
According to overlapping between parsing time and described time period that each network address is corresponding
Degree determines the brightness of indications and shows;
Described 3rd display module is resolved to this selected sign in obtaining the described time period
Each network address of the network address that symbol is corresponding and the network address that each gets solve
Number of times and the time of parsing of the network address corresponding to this selected indications is arrived in analysis;According to each
The indications that one corresponding number of times of size of selection of times corresponding to the individual network address is corresponding
And show;There is the indications corresponding to the network address of different number of times and have different big
Little;According to the registration resolved between time and described time period that each network address is corresponding
Determine the brightness of indications and show.
Optionally, this device also includes:
6th display module is corresponding for the indications obtaining this selected at the second display module
Each network address that the network address was resolved within the selected time period and/or the 3rd exhibition
The network ground that this selected indications is corresponding it is resolved in showing the time period selected by module acquisition
After each network address of location, show second and interface is shown corresponding to each parsing class
The number of the network address of type and/or ratio;
Wherein, described parsing type is with at least one Types Below: IPv4 address record, another name
Record, name server record, initial authority's record, pointer record, e-mail intersection record,
Text entry, IPv6 address record, positioning service record, represent title record, entrust sign and issue
Person's record.
Second aspect, present invention also offers a kind of methods of exhibiting analyzed for domain name, including:
Show that in interface, displaying one is used for representing indications to be analyzed, described network first
Address is domain name addresses or IP address;
When receiving the forward query statement for a selected indications input, obtaining should
The network address corresponding to selected indications be resolved within the selected time period each
The network address, shows in interface first and shows for representing each network address got
Indications;
When receiving the Query instruction for a selected indications input, obtain institute
Each network of the network address corresponding to this selected indications it is resolved in the time period selected
Address, shows, first, the mark shown in interface for representing each network address got
Show symbol.
Optionally, described method also includes:
The network address corresponding to selected indications or whole indications is shown.
Optionally, obtain that the network address corresponding to this selected indications be resolved to each
The network address and/or acquisition are resolved to each net of the network address corresponding to this selected indications
After network address, described method also includes:
Show this selected indications and each network address got in interface first
Corresponding indications uses line and curve connection.
Optionally, described show each with get for this selected indications in interface first
Indications corresponding to the individual network address uses line and curve connection to include:
According to one form of parsing type selecting corresponding to each network address got with
It resolves the corresponding lines of type by mark corresponding with this network address for this selected indications
Showing that symbol is connected, the different types that resolve correspond to the lines of different shape;
Wherein, described parsing type is with at least one Types Below: IPv4 address record, another name
Record, name server record, initial authority's record, pointer record, e-mail intersection record,
Text entry, IPv6 address record, positioning service record, represent title record, entrust sign and issue
Person's record.
Optionally, the network address that this selected indications of described acquisition is corresponding is in the described time period
Each network address being inside resolved to includes:
The network address obtaining this selected indications corresponding was resolved within the described time period
Each network address and be resolved to number of times and the solution of each network address got
The analysis time;
Described acquisition is resolved to the network address that this selected indications is corresponding in the described time period
Each network address include:
The each of the network address corresponding to this selected indications it is resolved in obtaining the described time period
The individual network address and each network address translation got are to this selected indications pair
The number of times of the network address answered and parsing time;
Described displaying in interface first is shown for representing each network address got
Indications, including:
According to one size corresponding number of times phase of selection of times that each network address is corresponding
Corresponding indications is also shown;There is the indications tool corresponding to the network address of different number of times
There is different sizes;According to parsing time corresponding to each network address and described time period it
Between registration determine the brightness of indications and show.
Optionally, the network address that this selected indications of described acquisition is corresponding is when selected
Between each network address of being resolved in section and/or be resolved in the time period selected by obtaining
After each network address of the network address that this selected indications is corresponding, described method is also wrapped
Include:
Second show in interface show corresponding to each resolve type the network address
Number and/or ratio;
Wherein, described parsing type is with at least one Types Below: IPv4 address record, another name
Record, name server record, initial authority's record, pointer record, e-mail intersection record,
Text entry, IPv6 address record, positioning service record, represent title record, entrust sign and issue
Person's record.
In the present invention, it is possible to a network address was resolved within the selected time period its
His network address or be resolved to other network address form with indications of this network address
Show.In this way, can by a domain name or IP address and other IP addresses and other
The incidence relation visualization of associated dns name, technical staff can be according to the incidence relation shown to this
Domain name is analyzed, and reduces the complexity and workload analyzed.
Detailed description of the invention
Below in conjunction with the accompanying drawings, the detailed description of the invention of invention is further described.Hereinafter implement
Example is only used for clearly illustrating technical scheme, and can not limit this with this
Bright protection domain.
A kind of methods of exhibiting analyzed for domain name of one embodiment of the invention, as it is shown in figure 1,
The method includes may include that
Step 101, shows the sign of one network address to be analyzed of displaying in interface first
Symbol, the described network address is domain name addresses or IP address;
Step 102, is receiving the forward query statement for a selected indications input
Time, obtain the network address corresponding to this selected indications resolved within the selected time period
Each network address arrived, shows in interface first and shows for representing what each got
The indications of the network address;
Step 103, is receiving the Query instruction for a selected indications input
Time, it is resolved to the network address corresponding to this selected indications in the time period selected by acquisition
Each network address, shows in interface first and shows for representing each network got
The indications of address.
In the embodiment of the present invention, it is possible to a network address was resolved within the selected time period
To other network address or be resolved to other network address of this network address with indications
Form show.In this way, can be by a domain name or IP address and other IP addresses
Visualizing with the incidence relation of other associated dns name, technical staff can be closed according to the association shown
This domain name is analyzed by system, reduces the complexity and workload analyzed.
In the specific implementation, in above-mentioned step 101, can first show the 3rd exhibition
Show interface, make user show the 3rd and interface inputs domain name addresses or IP address and obtains
The domain name addresses of user's input or IP address, or can also obtain what antivirus software was intercepted
Unknown network address, or high in the clouds reports, according to antivirus software, the suspicious network ground determined
Location, or classification software not can determine that classification network address of exporting etc..Specifically how to obtain
Take the network address to be analyzed and have no effect on protection scope of the present invention.In the specific implementation, this
In indications can be expressed as a dot pattern.
In the specific implementation, in above-mentioned step 102 and step 103, can select user
During one indications, such as move the cursor in this indications and during click right, to user
The menu of the indications selected corresponding to this is provided, this menu can including, forward is inquired about, instead
To options such as inquiries.Or can also be that the forward that pass-through mode such as hot key inputs is inquired about, instead
To query statement.Specifically how obtaining corresponding query statement has no effect on the protection model of the present invention
Enclose.
If user have selected forward inquiry afterwards, then can obtain within the selected time period
With the domain name mapping record of the address that the network address that this indications is corresponding is resolved for needs, and
Inquire about the network address that in each domain name mapping record, this indications selected is corresponding to be resolved to
Which network address, shows each network address being resolved to an indications afterwards
Show in interface first.If user have selected Query, then can obtain selected
Time period in domain name solution with the network address corresponding to this selected indications as analysis result
New record, and inquire about the network address that this indications is corresponding in each domain name mapping record be by
Which network address translation, inquires about each network address obtained afterwards with a sign
Symbol is illustrated in the first displaying interface.
For the network address that will get for a network address and network to be analyzed ground
Location makes a distinction, and the indications of different shape can be used to be indicated.Further, in order to
IP address and domain name addresses in the network address that will get make a distinction, it would however also be possible to employ no
It is indicated with the indications of form.Such as use first kind indications represents network to be analyzed
Address, uses Equations of The Second Kind indications to represent the network address got in step 102 and step 103
In domain name addresses, use the 3rd class indications to represent and step 102 and step 103 get
IP address in the network address.Further, inhomogeneous indications here can have
Different patterns.
Before above-mentioned step 102 and step 103, it is also possible to obtain the time that user selects
Section.The mode obtaining the time period that user selects has multiple, and such as, one way in which is for carrying
For one for making user input selected time the 4th displaying interface, the 3rd shows interface
Mainly include two input frames, two timing nodes can be inputted for user, obtain user's input
Two timing nodes between time period of selecting as user time period.Or can also carry
For a 5th displaying interface mainly including time shaft, this time shaft is provided with one can be slided
Dynamic pattern when selecting on the bearing of trend of time shaft with certain length, obtains pattern when selecting
The time period that the time period covered selects as user.The most here time period can not also
It is the time period selected by user, and may refer to the time period that exhibiting device self is selected.
Specifically, if a domain name mapping record the earliest in the domain name mapping record got
The generation time is first time point, when the generation time of a domain name mapping record is second the latest
Between point, then can select the time period between first time point and the second time point.Another further aspect,
The side of the time period that the mode of the time period that above-mentioned user selects and exhibiting device automatically select
Formula can also perform simultaneously, such as can be first according to latter approach automatically select one bigger
Time period, within the bigger time period, above-mentioned step 102 will be performed for network address
Or each network address obtained by step 103 is all shown to the first displaying interface with indications
In, select a less time period, by little at this according to former mode for user afterwards
Obtained by performing above-mentioned step 102 or step 103 for a network address in time period
Each network address highlight with indications and be shown in the first displaying interface.So, Yong Hutong
Cross and select different relatively minor time slices, it is possible to observe a net within this bigger time period dynamically
Network address resolution to the network address or be resolved to the change of the network address of this network address
Situation.
In the specific implementation, the method can also include:
Step 104, by network address exhibition corresponding to selected indications or whole indications
Show.
Specifically, selected here indications can be the indications that user selects.Such as when
After user moves the cursor in an indications, the network ground that this indications of automatic Display is corresponding
Location, or after user moves the cursor in an indications, provide a user with the choosing of menu
Comprising the option of display domain name in Xiang, the title of such as this option can be display nodename.
If user have selected this option, then show the network address that this selected indications is corresponding.When
The most in actual applications, it is also possible to the network address corresponding for each indications is all displayed.
In the specific implementation, the network address here can be illustrated in the first displaying interface,
Show near the position of corresponding indications, it is also possible to show that other are shown in interface, now need
Each indications to use corresponding numbering indicate, and in other described displaying circle
Face is shown the relation between each network address with corresponding numbering.It addition, by network ground
While location is illustrated in the first interface, it is also possible to each network address is illustrated in one other
Show that interface the such as the 6th is shown in interface, further, show in interface the 6th, can
So that IP address and domain name are separately shown.
Being embodied as it is, in above-mentioned step 102 and step 103, it is also possible to will be for one
The indications that the network address of individual selected indications acquisition is corresponding makes with this selected indications
It is attached with lines.Advantage of this is that, can the most simply show a selected mark
Show the incidence relation of symbol and other indications.In actual application, use lines by indications
It is attached the process not being to be necessarily required to perform, if being such as only performed once step 102
Or step 103, then without using lines indications to be attached.Or, even if performing
Repeatedly step 102 or step 103, the indications that can perform each time to obtain uses difference
Color mark, also so be able to obtain corresponding incidence relation.
Further, the referred herein indications that this is selected and each network got
Indications corresponding to address uses line and curve connection to specifically include: get according to each
One form of parsing type selecting corresponding to the network address resolves the lines that type is corresponding with it
Indications corresponding with this network address for this selected indications is connected, different parsing types pair
Should be in the lines of different shape;
Wherein said parsing type is type-A, C NAME record type, SOA type or NS
Type.
Parsing type corresponding to each network address referred herein may refer to this network ground
Domain name mapping record between the network address that location is corresponding with this selected indications.In step
In 102, it it is the net that gets to each of the network address translation corresponding to this selected indications
The type of the domain name mapping record of network address, in step 103, is each network address quilt
It is resolved to the type of the domain name mapping record of the network address corresponding to this selected indications.
Advantage of this is that, it is possible to allow users to see selected indications pair intuitively
Parsing type between the network address that the network address answered directly associates, reduces and analyzes difficulty
Degree.
Specifically, parsing type here is with at least one Types Below: IPv4 address record,
Canonical name, name server record, initial authority's record, pointer record, e-mail are remembered alternately
Record, text entry, IPv6 address record, positioning service record, represent title record, trust
Sign originator record.
Concrete, different shape here can be specially different colors, it is also possible to refers to not
Same shape.
In the specific implementation, this selected indications of the acquisition in above-mentioned step 102 is corresponding
Each network address of being resolved within the described time period, the network address can specifically include:
The network address obtaining this selected indications corresponding was resolved within the described time period
Each network address and be resolved to number of times and the parsing time of each network address;
In step 103, the indications being resolved to this in obtaining the described time period selected is corresponding
Each network address of the network address includes:
The each of the network address corresponding to this selected indications it is resolved in obtaining the described time period
The individual network address and each network address translation are to network corresponding to this selected indications
The number of times of address and the time of parsing;
Now, in step 102 and step 103, show that in interface, displaying is used for representing first
The indications of each network address got, including:
According to one size corresponding number of times phase of selection of times that each network address is corresponding
Corresponding indications is also shown;There is the indications tool corresponding to the network address of different number of times
There is different sizes;According to parsing time corresponding to each network address and described time period it
Between registration determine the brightness of indications and show.
In this way, can show that the network address corresponding to selected indications exists to user
The number of times of each network address being resolved in the time period selected and parsing time and in choosing
Each network address translation is to the network address corresponding to this indications selected in the time period selected
Number of times and resolve the time, it is simple to user carries out domain name analysis.
Here the parsing time may refer to a network address translation to another network address
The life span of domain name mapping record.This life span can also be from corresponding domain name mapping note
Record obtains.Here registration may refer to the network address corresponding to the indications selected and obtains
The life span of the domain name mapping record that the network address getting is corresponding with time selected
Between the registration of section.In the specific implementation, if registration is higher, corresponding brightness can be got over
Greatly, if registration is relatively low, corresponding brightness is less.
In the specific implementation, in above-mentioned step 102, obtain this selected indications corresponding
Each network address of being resolved within the selected time period, the network address and/or, step
In rapid 103, in the time period selected by acquisition, it is resolved to the network that this selected indications is corresponding
After each network address of address:
Can also show second and interface is shown the network ground corresponding to each parsing type
The number of location and/or ratio;Described parsing type is with at least one Types Below: A record (bag
Include IPv4 address record, IPv6 address record), canonical name (C Name record), title
Server record (NS record), initial authority record (SOA record), pointer record,
Transfer intersection record (MX record), text entry, positioning service record by telegram, represent title note
Originator record is signed in record, trust.
When specifically applying, it is also possible to show in interface first or other displaying interfaces are opened up
Show the ratio shared by domain name mapping record of each parsing type within the selected time period.Ratio
If in 100 domain name mapping records as corresponding in the selected time period, corresponding to A record
The domain name mapping of type be recorded as 60, C NAME record type be 20, SOA record
Type and MX record everybody 10, then can show an A record type accounting be 60%, C
NAME record type accounting is 20%, SOA record type accounting is 10%, MX records class
Type accounting is the cake chart of 10%.
In the specific implementation, in the methods described above, if network to be analyzed in step 101
Address is a domain name addresses, then explanation is likely to be intended to check which this domain name addresses is resolved to
A little network address, now can obtain each network ground that this domain name addresses is resolved to the most automatically
Location is also shown by indications.
It is pointed out that when specifically applying, above-mentioned step 102 and the order of step 103
Can exchange, corresponding technical scheme also can reach same or like effect, accordingly,
Also protection scope of the present invention should be fallen into.
A kind of displaying analysis method provided the present invention below in conjunction with possible displaying process is entered
Row explanation, as in figure 2 it is shown, the method may include steps of:
Step 201, show first displaying interface, second show interface, the 3rd show interface,
5th shows interface, the 6th displaying interface.
Wherein, the 3rd shows that interface is for inputting the network address to be analyzed, the first exhibition for user
Show that interface is for showing indications and incidence relation, the second displaying interface use of each network address
It is used for making corresponding to each parsing number of the network address of type, the 5th displaying interface in showing
User inputs selected time period, the 6th shows that interface is opened up for showing in the first displaying interface
The network address that each indications of showing is corresponding.
Fig. 2 A illustrates a kind of possible schematic diagram showing picture obtained after step 201, its
In, first shows that interface is positioned at the central authorities of display picture, and second shows that picture is positioned at display picture
Lower left, the 3rd show interface mainly include an input frame, be available for user and input an address
Or IP address, it is domain name addresses myserver.f3322.org that user have input.Additionally
3rd shows that interface also includes resolution and two Option Boxs of reverse resolution, when user is just selecting
In time resolving, search the network address that the network address translation being input in the 3rd displaying interface is arrived
And it is shown as corresponding indications in the first displaying interface, when user selects reverse resolution,
Search the network address being resolved to be input to the network address in the 3rd displaying interface and first
Show in interface and be shown as corresponding indications.Fig. 2 A is illustrated that and have selected resolution
Situation.5th shows that interface mainly includes a horizontal time shaft, and along this time shaft
There is pattern when selecting of span of correspondence, during initial selected by the user shown in figure on direction
Between section be the situation of 2014/12/06-2014/12/09.
Step 202, shows first and shows in interface that one uses expression to be input to the 3rd displaying
The indications of the network address in interface, and show the network ground being input in the 3rd displaying interface
The indications corresponding to the network address that location was resolved within the selected time period.
Fig. 2 B shows the signal at the first displaying interface in the picture shown after step 202
Figure, wherein shows, first, indications A comprising a house shape in interface.This house shape figure
Mark is for representing the domain name addresses of input in the 3rd displaying interface
The indications of myserver.f3322.org.Wherein also show the identifier B of a square block,
This square block identifier B is the resolution of the domain name addresses being input in the 3rd displaying interface
Result.
First, step 203, after user selectes an indications, shows that in interface, displaying should
The menu that indications is corresponding.
Fig. 2 C shows the signal of the menu for the indications B show shown in step 202
Figure, this menu includes even two submenus, and wherein the first submenu includes a display node
The project of title, after user clicks on the project of display nodename, can be in selected indications
Place shows the network address of this indications.Second submenu includes resolution and reverse resolution two
Individual project, user is by clicking on resolution input forward query statement, by clicking on reversely solution
Analysis input Query instruction.Owing to now the first displaying picture only wrapping in addition to indications A
Containing indications B, in the 6th displaying interface, therefore only include the address of an indications,
This address is
Step 204, when user selects resolution, the indications obtaining this selected is corresponding
Each network address that the network address was resolved within the described time period and be resolved to each
The number of times of the individual network address got and parsing time, corresponding according to each network address
The corresponding indications of one corresponding number of times of size of selection of times and be illustrated in the first boundary
In face;There is the indications corresponding to the network address of different number of times there is different sizes;
True according to the registration resolved between time and described time period that each network address is corresponding
Determine the brightness of indications and show.
Step 205, when user selects reverse resolution, is resolved to this in obtaining the described time period
Each network address of the network address that selected indications is corresponding and each get
The network address translation is to the number of times of the network address corresponding to this selected indications and when resolving
Between, relative according to one corresponding number of times of size of selection of times that each network address is corresponding
The indications answered also is shown;There is the indications corresponding to the network address of different number of times have
Different sizes;There is the indications corresponding to the network address of different number of times and have different
Size;According to overlapping between parsing time and described time period that each network address is corresponding
Degree determines the brightness of indications and shows.
Meanwhile, in step 204 and step 205, by selected indications with get each
The indications use line and curve connection that the network address is corresponding, and according to each network got ground
One form of parsing type selecting corresponding to location resolves the corresponding lines of type by this choosing with it
The fixed indications indications corresponding with this network address is connected, and the different types that resolve are not corresponding to
Lines with form.And in the indications shown in step 204 and step 205, domain name addresses with
Round point shape identifier represents, IP address represents with square block identifier.
Step 206, when user selects address query statement, shows this selected indications
The network address.
Second, step 207, shows that showing interface resolves the network address of type corresponding to each
Number.
The 6th, step 208, shows that showing interface first shows each sign shown in interface
The network address that symbol is corresponding.
In the specific implementation, step 203-step 206 here can be held for multiple indications
OK, step 207 and step 208 perform the most in real time, perform step 204 or step each time
After 205, show that to second interface and the 6th shows that interface is updated.
Fig. 2 D shows the signal of the display picture after performing Query for indications B
Figure, performs, including for indications B, the indications that Query is shown;Due to first
Show in interface, only comprise a square block pattern, therefore on the 6th IP boundary showing interface
Show only an IP address in face, domain name addresses is 32.Show in interface second, exhibition
Show A be recorded as 3, MX be recorded as 2, first, corresponding shows that in interface, A records right
The connecting line (continuous lines) answered have 3, connecting line corresponding for MX record (dashed line) have 2
Bar.
Fig. 2 E shows a kind of possible display picture after performing repeatedly forward and Query
The schematic diagram in face.Show in interface first, comprise three square block patterns, 40 round point shapes
Pattern, corresponding illustrates three IP addresses, domain name in the 6th IP interface showing interface
Sub-interface shows there are 40 domain name addresses.Show in interface first, the company that A record is corresponding
The connecting line that wiring has 7, MX record is corresponding has 1, and the connecting line that SOA record is corresponding has 1
Bar, the connecting line that NS record is corresponding has 1, in the second corresponding displaying interface, shows A note
Record is 7, MX be recorded as 2, SOA be recorded as 1, NS be recorded as 1.In the 5th exhibition
Showing in interface, the selected time period is 2014/11/29-2014/11/04 day, shows first
Also illustrating a cake chart in interface, this cake chart is for representing within the selected time period
Each resolves the ratio shared by domain name mapping record of type.Show in interface first and also show that
One block diagram, this block diagram for represent the IP address shown in the first displaying interface
Number and the number of domain name.
It is pointed out that in the embodiment of the present invention, the 5th shows that pattern when selecting in interface can
Perform with any time at said method, such as can perform step 205-step 209
Perform afterwards, now according to the selected time period by each mark being selected within this time period
Show that symbol and the query statement performed for this indications obtain the corresponding network address and show.
The indications that different network nodes is corresponding should be illustrated in different positions.In the specific implementation,
The network ground that can also will get according to step 205 or step 206 in all periods
Location is shown in the first displaying interface simultaneously, during pattern is trailing when selecting, only uses line
The indications that the network address relevant in bar connection present period is corresponding, and only by current slot
Bright (seeing Fig. 2 D and Fig. 2 E) is marked in the interior relevant network address.
Present invention also offers a kind of exhibiting device analyzed for domain name, as it is shown on figure 3, bag
Include:
For showing first, first display module 301, shows in interface that one is treated for expression
The indications of the network address analyzed, the described network address is domain name addresses or IP address;
Second display module 302, for receiving for a selected indications input
During forward query statement, obtain the network address corresponding to this selected indications when selected
Between each network address of being resolved in section, show first and interface is shown be used for representing every
The indications of one network address got;
3rd display module 303, for receiving for a selected indications input
During Query instruction, it is resolved to this selected indications in the time period selected by acquisition corresponding
Each network address of the network address, show first and interface is shown be used for representing each
The indications of the network address got.
One network address can be existed by the exhibiting device for domain name analysis that the present invention provides
Other network address of being resolved in the selected time period or be resolved to this network address
Other network address are shown with the form of indications.In this way, can be by a domain name
Or the incidence relation visualization of IP address and other IP addresses and other associated dns name, technical staff
According to the incidence relation shown, this domain name can be analyzed, reduce the complexity and work analyzed
Measure.
Optionally, this device also includes:
4th display module 304, for by corresponding to selected indications or whole indications
The network address show.
Optionally, this device also includes:
5th display module 305, for obtaining this selected indications at the second display module 302
Each network address and/or the 3rd display module 303 that the corresponding network address is resolved to obtain
After taking each network address being resolved to the network address corresponding to this selected indications, the
One shows mark corresponding with each network address got for this selected indications in interface
Show that symbol uses line and curve connection.
Further, described 5th display module 305 is specifically for getting according to each
One form of parsing type selecting corresponding to the network address resolves the lines that type is corresponding with it
Indications corresponding with this network address for this selected indications is connected, different parsing types pair
Should be in the lines of different shape;
Wherein said parsing type is with at least one Types Below: IPv4 address record, another name note
Record, name server record, initial authority record, pointer record, e-mail intersection record, literary composition
This record, IPv6 address record, positioning service record, represent title record, entrust sign originator
Record.
Optionally, the second display module 302 is for obtaining the network that this selected indications is corresponding
Each network address that address was resolved within the described time period and be resolved to each and obtain
The number of times of the network address got and parsing time;According to each network address corresponding time
Count the corresponding indications of one corresponding number of times of size of selection and show;There are different times
The indications corresponding to the network address of number has different sizes, according to each network address
The corresponding registration between parsing time and described time period determines the brightness of indications and opens up
Show;
3rd display module 303 is resolved to this selected indications in obtaining the described time period
Each network address of the corresponding network address and each network address translation got
Number of times and the time of parsing to the network address corresponding to this selected indications;According to each
The corresponding indications of one corresponding number of times of size of selection of times corresponding to the network address is also
Show;There is the indications corresponding to the network address of different number of times there is different sizes,
True according to the registration resolved between time and described time period that each network address is corresponding
Determine the brightness of indications and show.
Optionally, this device can also include:
6th display module 306, for obtaining this selected indications at the second display module 302
Each network address that the corresponding network address was resolved within the selected time period and/or
The indications being resolved to this selected in time period selected by 3rd display module acquisition is corresponding
After each network address of the network address, show in interface second and show corresponding to each
Resolve number and/or the ratio of the network address of type;Described parsing type is with Types Below extremely
One of few: IPv4 address record, canonical name, name server record, initial authority records,
Pointer record, e-mail intersection record, text entry, IPv6 address record, positioning service record,
Represent title record, entrust and sign originator record.