Detection method and system for target domain name hijacking

Abstract

The invention provides a detection method and system for target domain name hijacking. The method comprises the steps that a server side adopts a mode of sending a domain name analysis request to an authority DNS server of the target domain name and receiving at least one analysis result of the target domain name returned by the authority DNS server to establish a standard analysis result list; the server side allocates the domain name to multiple specific client sides to execute a target domain name analysis probing task, and each client side sends the received target domain name to an LDNS server configured for the client side to request domain name analysis and reports the received analysis result to the server side; the server compares each received analysis result which is adopted as a probing task with a standard analysis result recorded by the standard analysis result list, and therefore whether a hijacking behavior exists in the LDNS server configured for the server side or not is determined.

Description

technical field [0001] The invention relates to the field of network information security, in particular to a detection method and system for target domain name hijacking. Background technique [0002] With the development of the Internet industry, the Internet has become a part of people's lives, such as shopping, watching movies, reading news, publishing literary works, etc. through the Internet. When people use the Internet, they first need to log in to a certain website domain name to enter the place they want to go, such as logging in to Taobao to go shopping, logging to Sina.com to watch news, and so on. The Internet has brought great convenience to people's lives, but at the same time, network information security has increasingly become a serious problem that affects users' online experience. [0003] Domain name hijacking is one of many problems of network information security. Domain name hijacking is a way of Internet attack. By attacking the domain name system ...

AI Technical Summary

Problems solved by technology

After this kind of enterprise downloads and hosts its software products to a third-party service provider, the domain name of the enterprise is often connected to the domain name of the third-party service provider in the form of CNAME. The enterprise cannot perceive the service quality provided by its domain name website. When the client reports that there is an abnormality in accessing the website that provides APP product downloads, the company cannot detect whether the domain name accessed by the client has DNS hijacking behavior using the existing domain name hijacking method.

Images