Monitoring method and device based on enterprise domain name security

Abstract

The present invention provides a monitoring method and device based on enterprise domain name security, including: obtaining data information of a suspected target domain name similar to a reference domain name address in a target object; performing information event processing on the obtained data information to obtain an event Database; conduct relevant analysis on the event database, and determine accurate and suspected target events according to the analysis results; conduct active defense processing on the obtained target events in real time, so as to realize active operation and maintenance of enterprise domain name service security monitoring, which can monitor domain names in real time The risk of hijacking attacks can make up for the security monitoring of corporate domain names in addition to DNS server passive defense and user active alarms; and it can also monitor the dynamics of phishing websites in real time, monitor alarms in real time, and domain names for corporate capital transactions can clearly increase corporate active operation and maintenance The ability to monitor and control risks. In addition, the use of big data analysis and processing methods makes the analysis results more accurate and reliable.

Description

technical field [0001] The invention relates to the field of domain name security monitoring, in particular to a monitoring method and device based on enterprise domain name security. Background technique [0002] Domain Name (Domain Name) is the name of a computer or computer group on the Internet consisting of a string of dot-separated names. It is used to identify the electronic location of the computer during data transmission, and all computer-based website services are Start with Domain Name Services. [0003] In CDC, the registration of each domain name is unique and non-repeatable. Therefore, domain name is a relatively limited resource on the Internet, and its value will gradually be valued by people as the number of registered companies increases. Moreover, domain names also have the function of business identification. For example, in the banking industry, a simple and easy-to-remember domain name often means unlimited business opportunities; because of this, the...

AI Technical Summary

Problems solved by technology

In the above situation, for the enterprise, it cannot know in advance that the domain name server used by itself has been changed. Only when the user complains or the enterprise itself finds a phishing website as a user, will it know that the domain name server it uses has been changed. ; For the operator, first of all, it is not obliged to monitor the domain name changes of each enterprise in real time, and even if it finds that the corresponding enterprise domain name server has been changed, it still cannot know that the change of the domain name server is implemented by the enterprise itself It is still implemented by hackers, so it is impossible to deal with the change of the domain name server

[0005] The inventor found in the research that the overall anti-attack ability and anti-risk ability of the existing network security technology is seriously insufficient, and its construction and operation are not standardized, so that there is no corresponding defense method to solve the security problem of the enterprise domain name; therefore, for the above-mentioned enterprises The domain name security problem has not yet proposed an effective solution

Images