DNS tunnel detection method and DNS tunnel detection device

Abstract

The embodiment of the invention discloses a DNS tunnel detection method and a DNS tunnel detection device. The method comprises the steps of recognizing a plurality of main domain names included by passive DNS data; building at least one detection domain corresponding to the main domain names, wherein the number of the domain names included by the detection domain is less than or equal to a firstthreshold; if the detection domain comprises a DNS wildcard character domain name, discarding the DNS wildcard character domain name in the detection domain; and recognizing the detection domain applied to a DNS tunnel. According to the method and the device provided by the invention, user information of a client is not involved during a detection process, so that invasion of privacy is avoided, alot of insignificant sub-domain name records Wildcard can be discarded, records generated by Wildcard are filtered out, and the situation that lots of abnormal sub-domain names exist under one domainby lots of the insignificant records can be eliminated; if the detection domain applied to the DNS tunnel is determined, defense can be performed on the detection domain applied to the DNS tunnel, and thus the situation that a malicious client builds the DNS tunnel with an external DNS is avoided, and security during a data transmission process is ensured.

Description

technical field

[0001] The invention relates to the technical field of the Internet, in particular to a DNS tunnel detection method and a DNS tunnel detection device. Background technique

[0002] Domain Name System (English full name: Domain Name System, English abbreviation: DNS) is one of the most critical basic services of the Internet. It maps domain names and IP addresses to each other, so that people can easily access the Internet without having to memorize complicated IP addresses. The DNS protocol will basically not be intercepted by firewall policies. Even in an enterprise internal network, a DNS server is required for domain name resolution. Moreover, in order to be able to resolve domain names on the Internet, the DNS server within the enterprise needs to communicate with other DNS servers on the Internet. Communication, which creates conditions for the construction of covert channels based on the DNS protocol. Since the DNS tunnel client only needs to request t...

Images