Method and device for controlling malicious domain name and illegal access

Abstract

The invention relates to the technical field of network security, in particular to a method and device for controlling a baleful domain name and illegal access. The device is characterized in that middleware comprises a kernel mode protocol stack data packet intercepting module, a user mode DNS (Domain Name Server) resolution module, a control strategy module, a black / white list index database module, a black / white list matching module, and a log module, wherein the kernel mode protocol stack data packet intercepting module is located at the front end of the user mode DNS resolution module; the control strategy module is connected with the output of the user mode DNS resolution module; the output end of the control strategy module is connected with the log module; the control strategy module is connected with the black / white list matching module; the black / white list matching module is connected with the black / white list matching index database module. Compared with the prior art, the method and device can improve the security of domain name service from aspects of universality, usability, controllability, security, timeliness, effectiveness and the like.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method of efficiently blocking and isolating malicious domain name access by deploying a secure domain name server middleware on a server running DNS server software (BIND 9). A method and device for controlling malicious domain names and illegal access that can also effectively control illegal visitors. Background technique [0002] DNS is the Domain Name System (Domain Name System), which is a hierarchically authorized distributed data query system. It is mainly used to complete the translation and conversion function of domain names to IP addresses. The vast majority of Internet communications must first complete the addressing conversion from domain names to IP addresses through the domain name system, so the domain name system has become one of the key infrastructures for the normal operation of the entire Internet. [0003] Currently, DNS has become the weakest ...

AI Technical Summary

Problems solved by technology

[0004] In the prior art, processing technologies for malicious domain names mainly include four types: (1) Using domain name resolution software: Currently, more than 95% of domain name resolution software uses BIND, which has a blacklist filtering function, but has the following defects: blacklist The update needs to stop the domain name resolution service, which greatly affects the availability of the system; when the amount of data is large, it affects the performance of the system, and the number of blacklists is limited

(2) Gateway system for DNS filtering: Cheswick and others at Bell Labs proposed a security gateway system for DNS filtering, which runs in the network in the form of a firewall. The disadvantage is that it uses filtering rules for processing, and the speed and efficiency are relatively low Low, when there are many filtered domain names, the availability of domain name resolution services will be greatly reduced

(3) DNS systems with security functions, such as OpenDNS, filter malicious websites through the list of malicious websites it collects. Although the security is improved, its scope of application is small, the number of users is very small, and its versatility is poor

Disadvantage: It can only perform corresponding configuration filtering for specific access areas, but cannot perform effective security filtering for DNS servers. At the same time, because most of them use router-based filtering rules, it is not suitable for processing large-scale massive black and white lists. Filtering business cannot meet real-time processing requirements

(5) The secure domain name server technology has been modified on the BIND source code, breaking the integrity of the domain name server

The above-mentioned existing malicious domain name control technology has certain problems in terms of usability, versatility and controllability, so there is an urgent need for a control method that does not affect the normal service of domain name resolution and can ensure security

Images