Evaluation method and device of DNS

Abstract

The embodiment of the invention relates to the field of network security, and in particular relates to an evaluation method and device of a DNS. The accuracy of the DNS evaluation is improved through the method and device disclosed by the invention. The evaluation method comprises the following steps: determining M domain names in a DNS system and multiple feature dimension information of each type of the preset types corresponding to each domain name in M domain names according to a DNS traffic log, wherein M is an integer more than and equal to 1; determining association identification information associated with each domain name in M domain name, wherein the association identification information comprises an IP address and / or identity information; determining a cluster score of each type of the preset types of the DNS system according to the association relation between each domain name in the M domain names and the association identification information, or the attribute information of each domain name in M domain names; and determining the total system score of the DNS system according to the cluster score of each type of the preset types of the DNS system. Therefore, the accuracy of the DNS evaluation is improved.

Description

technical field [0001] The embodiment of the present invention relates to the field of network security; in particular, it relates to a DNS evaluation method and device. Background technique [0002] In network communication, to access a server on the Internet, you must access it through an IP address, but the IP address is not easy to remember. Therefore, when accessing a server, you usually enter the corresponding input domain name. In this way, the domain name needs to be resolved. For the corresponding IP address, the client server can only access the server corresponding to the corresponding domain name after obtaining the IP address corresponding to the domain name. The mapping relationship from the domain name to the IP address is completed through the domain name resolution system. [0003] Domain Name Service (DNS for short) is a distributed database that maps domain names and IP addresses on the Internet. The domain name system is not only used to solve the problem...

AI Technical Summary

Problems solved by technology

Malicious DNS is highly harmful and will cause property loss to users, and may even lead to website or network paralysis in severe cases

[0004] At present, the evaluation of DNS is based on the analysis of a single domain name, that is, the malicious degree of a single domain name is evaluated only from the number of client visits. Since the evaluation of DNS is only based on one dimension of a single domain name, it is evaluated from one direction of malicious degree Evaluation will result in lower credibility of evaluation results

Images