Monitoring method and device based on enterprise domain name safety

Abstract

The invention provides a monitoring method and device based on enterprise domain name safety. The method comprises the steps of: obtaining data information of a suspected target domain name similar to a reference domain name address from target objects; carrying out information event processing on the obtained data information, and obtaining event database; carrying out related analysis on the event database, and determining an accurate target event and a suspected target event according to the analysis result; and carrying out active defense processing on the obtained target events so as to realize active operation of enterprise domain name service safety monitoring. By adopting the monitoring method and device, the risk of domain name hijacking and attacking is monitored in real time, the enterprise domain name safety monitoring capability besides DNS server passive defense and user active alarming is remedied, a fishing website is dynamically monitored in real time, real-time monitoring and warning are realized, and aimed at a fund transaction domain name of the enterprise, the enterprise active operation monitoring and risk handling capability is clearly improved; in addition, a large data analyzing and processing mode is adopted, so that the analysis result is relatively high in accuracy and reliability.

Description

technical field [0001] The invention relates to the field of domain name security monitoring, in particular to a monitoring method and device based on enterprise domain name security. Background technique [0002] Domain Name (DomainName) is the name of a certain computer or computer group on the Internet consisting of a string of dot-separated names. It is used to identify the electronic location of the computer during data transmission, and all computer-based website services must Start with domain name services. [0003] In CDC, the registration of each domain name is unique and non-repeatable. Therefore, domain name is a relatively limited resource on the Internet, and its value will gradually be valued by people as the number of registered companies increases. Moreover, domain names also have the function of business identification. For example, in the banking industry, a simple and easy-to-remember domain name often means unlimited business opportunities; because of t...

AI Technical Summary

Problems solved by technology

In the above situation, for the enterprise, it cannot know in advance that the domain name server used by itself has been changed. Only when the user complains or the enterprise itself finds a phishing website as a user, will it know that the domain name server it uses has been changed. ; For the operator, first of all, it is not obliged to monitor the domain name changes of each enterprise in real time, and even if it finds that the corresponding enterprise domain name server has been changed, it still cannot know that the change of the domain name server is implemented by the enterprise itself It is still implemented by hackers, so it is impossible to deal with the change of the domain name server

[0005] The inventor found in the research that the overall anti-attack ability and anti-risk ability of the existing network security technology is seriously insufficient, and its construction and operation are not standardized, so that there is no corresponding defense method to solve the security problem of the enterprise domain name; therefore, for the above-mentioned enterprises The domain name security problem has not yet proposed an effective solution

Images