Fraud-related domain name blocking method, device, system and equipment

Abstract

The invention relates to a fraud-related domain name blocking method, device, system and equipment, and the system comprises a fraud-related blocking server which is used for receiving a blocking instruction and generating a domain name blacklist based on the blocking instruction; the flow detection server is used for acquiring a DNS request sent by a terminal and sending a mirror DNS message to the fraud-related plugging server based on the DNS request; and the fraud-related plugging server is also used for receiving the mirror image DNS message sent by the flow detection server, judging whether the mirror image DNS message is a fraud-related domain name based on the domain name blacklist, and obtaining a domain name resolution result corresponding to the DNS request. According to the method, the independent fraud-related plugging server is arranged, and the mirror DNS message is detected through the fraud-related plugging server, so that the problems that a block of cache needs to be occupied independently through local DNS plugging, and the buffer performance and the normal perception of a user are reduced along with the increase of the plugging amount can be avoided; and the blocking efficiency of fraud-related domain names can be improved to a great extent.

Description

Technical Field

[0001] The present disclosure relates to the technical field of domain name resolution, and in particular to methods, devices, systems and equipment for blocking fraudulent domain names. Background Art

[0002] In order to implement the spirit of the meeting on combating and managing telecommunications fraud and fully implement prevention, control and management measures, the superior department has established an anti-fraud system (anti-fraud platform), which is connected to the operator's DNS (Domain Name System) through ISMS (Information Security Management Systems), and sends domain name blocking and unblocking instructions to the local operator's DNS network management server, which then sends instructions to the cache DNS and recursive DNS to complete the corresponding blocking and unblocking operations.

[0003] In the related technology, local DNS blocking in the existing network needs to occupy a separate cache address table, which is the same cache occupied by normal user resolution. As the amount of blocking increases, it is necessary to continuously expand the capacity, and as the number of blocked entries increases, the access table lookup time of normal users will be extended, which will reduce the performance of the cache and affect the access of normal users, resulting in the problem of low efficiency of fraud-related blocking in the related technology. Summary of the invention

[0004] The present invention provides a method, device, system and equipment for blocking fraudulent domain names.

[0005] According to a first aspect of the present disclosure, a system for blocking fraudulent domain names is provided, the system comprising:

[0006] A fraud blocking server, used to receive a blocking instruction and generate a domain name blacklist based on the blocking instruction;

[0007] A traffic detection server, used to obtain a DNS request sent by a terminal, and send a mirror DNS message to the fraud blocking server based on the DNS request;

[0008] The fraud blocking server is also used to receive the mirror DNS message sent by the traffic detection server, determine whether the mirror DNS message is a fraud-related domain name based on the domain name blacklist, and obtain the domain name resolution result corresponding to the DNS request.

[0009] According to a second aspect of the present disclosure, a method for blocking a fraud-related domain name is provided, the method being applied to a fraud-related blocking server, the method comprising:

[0010] Receiving a blocking instruction, and generating a domain name blacklist based on the blocking instruction;

[0011] Receiving a mirror DNS message sent by a traffic detection server; wherein the mirror DNS message is generated based on a DNS request sent by a terminal;

[0012] Based on the domain name blacklist, determine whether the mirror DNS message is a fraud-related domain name, and obtain a corresponding domain name resolution result; wherein the domain name resolution result includes an empty domain name resolution result or a domain name resolution result actually corresponding to the mirror DNS message.

[0013] According to a third aspect of the present disclosure, a device for blocking a fraudulent domain name is provided. The device is applied to a fraudulent blocking server, and the device includes:

[0014] A domain name blacklist generation module, used to receive a blocking instruction and generate a domain name blacklist based on the blocking instruction;

[0015] A message receiving module, used to receive a mirror DNS message sent by a traffic detection server; wherein the mirror DNS message is generated based on a DNS request sent by a terminal;

[0016] A domain name resolution module is used to determine whether the mirror DNS message is a fraudulent domain name based on the domain name blacklist, and obtain the domain name resolution result corresponding to the DNS request; wherein the domain name resolution result includes an empty domain name resolution result or a domain name resolution result actually corresponding to the mirror DNS message.

[0017] According to a fourth aspect of the present disclosure, an electronic device is provided, which includes a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the program, the method described above is implemented.

[0018] According to a fifth aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the above method of the present disclosure is implemented.

[0019] According to a sixth aspect of the present disclosure, a computer program product is provided, comprising a computer program, wherein the computer program implements the above method of the present disclosure when executed by a processor.

[0020] The method, device, system and equipment for blocking fraud-related domain names provided by the embodiments of the present disclosure are as follows: the fraud-related blocking server can receive the blocking instruction sent by the superior anti-fraud platform, and generate a domain name blacklist according to the blocking instruction; when the traffic detection server obtains the DNS request sent by the terminal, it can generate a mirror DNS message based on the DNS request, and send the mirror DNS message to the fraud-related blocking server; the fraud-related blocking server determines whether the mirror DNS message is a fraud-related domain name through the generated domain name blacklist, and obtains the corresponding domain name resolution result. In this way, by setting up an independent fraud-related blocking server and detecting the mirror DNS message through the fraud-related blocking server, it is possible to avoid the need to occupy a separate cache through local DNS blocking, and the problem of decreased buffering performance and normal user perception caused by the increase in the amount of blocking, thereby greatly improving the blocking efficiency of fraud-related domain names. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Further details, features and advantages of the present disclosure are disclosed in the following description of exemplary embodiments in conjunction with the accompanying drawings, in which:

[0022] Figure 1 It is a business scenario diagram of related technologies;

[0023] Figure 2 A schematic diagram of a business process for blocking fraudulent domain names provided by an exemplary embodiment of the present disclosure;

[0024] Figure 3 A schematic diagram of a system architecture provided for an exemplary embodiment of the present disclosure;

[0025] Figure 4 A flowchart of a method for blocking a fraudulent domain name provided by an exemplary embodiment of the present disclosure;

[0026] Figure 5 A schematic block diagram of the functional modules of a device for blocking a fraudulent domain name provided by an exemplary embodiment of the present disclosure;

[0027] Figure 6 A structural block diagram of an electronic device provided for an exemplary embodiment of the present disclosure;

[0028] Figure 7 A structural block diagram of a computer system provided for an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0029] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0030] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0031] The term "including" and its variations used in this document are open inclusions, that is, "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one other embodiment"; the term "some embodiments" means "at least some embodiments". Relevant definitions of other terms will be given in the description below. It should be noted that the concepts of "first", "second", etc. mentioned in this disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0032] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0033] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0034] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0035] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0036] As an optional but non-limiting implementation, in response to receiving an active request from the user, the method of sending a prompt message to the user may be, for example, a pop-up window, in which the prompt message may be presented in text. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device. It is understandable that the above notification and the process of obtaining user authorization are only illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0037] In the relevant technology, the network elements involved mainly include: superior anti-fraud platform, ISMS, local DNS network management and various DNS servers, etc.

[0038] Specifically, Figure 1 As shown, Figure 1 This is a business scenario diagram of the related technology. Specifically, the following steps may be included:

[0039] Step 1: The central anti-fraud platform issues a blocking instruction for a certain domain name or a batch of domain names.

[0040] Step 2: After receiving the instruction, the provincial anti-fraud platform returns a response to the central anti-fraud platform.

[0041] Step 3: The provincial anti-fraud platform issues corresponding blocking instructions to ISMS.

[0042] Step 4: After receiving the instruction, ISMS returns a response to the provincial anti-fraud platform.

[0043] Step 5: ISMS sends the received blocking instruction to the corresponding local DNS network management.

[0044] Step 6: After receiving the instruction, the DNS network manager returns a response to the ISMS.

[0045] Step 7: The DNS network manager performs forced resolution on the domain name, sends the resolution result to each server, and refreshes the cache of this domain name.

[0046] Step 8: Each DNS server returns the result after executing the command.

[0047] Step 9: The DNS network manager returns the final result of the instruction execution to the ISMS.

[0048] Step 10: Return the execution result, that is, ISMS returns the final result of the instruction execution to the provincial anti-fraud center.

[0049] Step 11: Return the execution result, that is, the provincial anti-fraud platform returns the final result of the instruction execution to the central anti-fraud platform.

[0050] Step 12: When the user sets the DNS to local DNS, request the relevant fraud domain name.

[0051] Step 13: The local DNS directly returns the resolution result set by the user to achieve the blocking purpose.

[0052] Therefore, the related technology will have the following technical problems:

[0053] 1. In the relevant technology, domain name blocking is based on forcibly resolving the cached DNS of this network into relevant resolution results. There is no ability to supervise and block the DNS of other networks outside the country, the DNS privately built in the country, and the DNS registered in the country but not in the operating system. According to statistics, the total number of visits to these domain names accounts for about 30% of the total number. If the customer actively configures to bypass supervision or performs passive configuration due to reasons such as DNS hijacking, there is a situation where the local DNS and the domestic network are bypassed and access can continue. The existence of these unregulated traffic will cause adverse social impacts at the least and affect the country's political security at the most. In addition, it is impossible to achieve the rapid disposal and dynamic blocking capabilities of "one-point issuance, effective across the entire network", affecting the overall network anti-fraud effectiveness.

[0054] 2. Local DNS blocking in the existing network requires a separate cache address table, which is the same as the cache occupied by normal user resolution. As the amount of blocking increases, it needs to be continuously expanded. Moreover, as the number of blocked entries increases, the access table lookup time of normal users will be extended, resulting in reduced cache performance and reduced user perception.

[0055] 3. Since blocking and monitoring exist in the same channel and are connected to multiple blocking command channels, there is a problem of insufficient performance of individual cache servers during the peak period of commands, resulting in blocking failure. The success rate of blocking disposal may not reach more than 90%, resulting in low blocking efficiency.

[0056] Therefore, in order to solve the above technical problems, the embodiment of the present disclosure is connected to the ISMS command channel to build a black and white list library, collect and analyze the provincial network export traffic, analyze and judge the DNS request packet sent by the user, and if it is a fraud-related and illegal domain name, construct a resolution response packet, for example, modify the domain name resolution record to 0.0.0.0 (IPV6:0:0:0:0:0:0:0:0:0) and return it to the user to complete the blocking.

[0057] The embodiment can solve the problem that users cannot complete the blocking of fraud-related domain names when using other network DNS to access them. It can also be used as an enhanced auxiliary tool for current fraud-related blocking. It is an effective supplement after the DNS forced resolution blocking mode fails, and can achieve a 100% blocking success rate. In addition, by setting up an independent fraud-related blocking server and intercepting fraud-related domain names through the fraud-related blocking server, it can avoid the problem that the local DNS blocking needs to occupy a separate cache, and the buffering performance and user normal perception decrease as the blocking amount increases.

[0058] The network elements involved in the embodiment may include: an upper-level anti-fraud platform, ISMS, a fraud blocking server and a switch. The upper-level anti-fraud platform sends a blocking and unblocking instruction, the ISMS transfers the instruction, the fraud blocking server sends a response packet to the switch, and the switch sends a response packet to the terminal on the user side.

[0059] For details, see Figure 2 As shown, Figure 2 A business process diagram of blocking fraudulent domain names provided in the embodiment of the present disclosure. It may include an anti-fraud platform, a fraudulent blocking server, a provincial network export DPI (Deep Packet Inspection) data detection server and a terminal. It may include the following steps:

[0060] Step 1: The central anti-fraud platform issues a blocking instruction for a certain domain name or a batch of domain names.

[0061] Step 2: After receiving the instruction, the provincial anti-fraud platform returns a response to the central anti-fraud platform.

[0062] Step 3: The provincial anti-fraud platform issues corresponding blocking instructions to ISMS.

[0063] Step 4: After receiving the instruction, ISMS returns a response to the provincial anti-fraud platform.

[0064] Step 5: ISMS sends the received blocking instruction to the fraud blocking server through the WEBLOGIC interface.

[0065] Step 6: After receiving the instruction, the fraud blocking server returns a response to the ISMS.

[0066] Step 7: The fraud blocking server builds a domain name blacklist table and sets the resolution result corresponding to this domain name to an empty domain name resolution result, for example, it can be 0.0.0.0 (IPV6:0:0:0:0:0:0:0:0:0.

[0067] Step 8: The user's terminal requests the fraudulent domain name.

[0068] Step 9: The corresponding DNS request data at the provincial network exit is diverted to the fraud blocking server.

[0069] Step 10: When the fraud blocking server finds that this domain name is in the blacklist, it constructs a data packet with an empty domain name resolution result as the resolution response result based on the source address, destination address, and requested domain name of the user's request, and sends it to the provincial network exit DPI data detection server.

[0070] Step 11: The provincial network egress DPI data detection server returns the domain name resolution result of the corresponding domain name resolution response to the user to achieve the purpose of blocking.

[0071] like Figure 3 As shown, Figure 3 A schematic diagram of the system architecture provided for the embodiment of the present disclosure. The fraud blocking server provided in the embodiment of the present disclosure includes two modules, one is the blocking management module; the other is the disposal program module. The blocking management module is mainly connected to the ISMS, receives the fraud blocking information issued by the superior department, establishes disposal tasks, establishes black and white lists, performs blocking statistics, log reporting, completes the blocked domain name testing work after blocking, etc. Among them, the white list is set to some important domain names such as top-level domain names, second-level domain names, and governments to prevent accidental blocking; the black list is the relevant disposal task information received from the ISMS. The blocking statistics mainly completes the statistics of the disposal success rate. The test module mainly completes the test work of whether this domain name is completely blocked after blocking. The disposal program module mainly receives DNS request messages, completes the tasks issued by the blocking management system, completes policy standardization matching, forges DNS response messages, performs log records, and issues disposal messages.

[0072] In the embodiment provided by the present disclosure, the ISMS sends a fraudulent domain name disposal instruction to the fraud blocking server as needed, and builds a detailed blacklist table according to the content of the instruction. The specific domain name disposal instruction content is shown in Table 1:

[0073] Table 1:

[0074]

[0075]

[0076] Among them, in Table 1, table entries are inserted and deleted according to the type processing type, such as stopping parsing is the establishment of a corresponding domain name blacklist, and resuming parsing is the deletion of a corresponding domain name blacklist.

[0077] After the blocking management interface builds the corresponding blacklist table, it will feedback the results of the fraudulent domain name disposal instructions as required. The disposal feedback instructions are shown in Table 2:

[0078] Table 2:

[0079]

[0080]

[0081] In the embodiments provided by the present disclosure, a whitelist library can also be established, and the whitelist is used to automatically filter the domain names of important primary, secondary, and government websites to prevent accidental blocking and group failure. Table 3 is a schematic diagram of the whitelist structure, as shown in Table 3:

[0082] Table 3:

[0083]

[0084] The processing program module in the embodiment mainly receives the DNS request data transmitted by the diversion in real time, and then retains the source address IP1, destination address IP2, domain name and other information requested by the user. It is determined whether the domain name requested by the user is in the white list. If it is, it is released without any interference; if not, it is further determined whether it is in the black list. If not, it is released without interference; if it is in the black list, a blocking operation is performed, and a message of an empty domain name resolution result such as 0.0.0.0 (IPV6:0:0:0:0:0:0:0:0) is constructed, and the data packet with the destination address of IP1 and the source address of IP2 is resolved and responded, and a log is recorded. By sending a resolution response message to the switch, the response message is forwarded to the terminal on the user side through the switch, and the terminal on the user side receives the response message. By responding the blocked response message to the user, the user cannot browse the website of this domain name after obtaining this resolution result, thereby achieving the purpose of fraud-related blocking.

[0085] Therefore, based on the above embodiments, the present disclosure also provides a system for blocking fraudulent domain names, which may include:

[0086] The fraud blocking server is used to receive blocking instructions and generate a domain name blacklist based on the blocking instructions.

[0087] The traffic detection server is used to obtain the DNS request sent by the terminal and send a mirror DNS message to the fraud blocking server based on the DNS request.

[0088] The fraud blocking server is also used to receive the mirror DNS message sent by the traffic detection server, determine whether the mirror DNS message is a fraud-related domain name based on the domain name blacklist, and obtain the domain name resolution result corresponding to the DNS request.

[0089] It is being implemented. For details, please refer to Figure 2As shown, the fraud blocking server can receive the blocking instruction sent from the anti-fraud platform, and generate a domain name blacklist based on the blocking instruction, which is the blacklist in the above embodiment. The traffic detection server in the embodiment can obtain the DNS request sent by the terminal, and generate a mirror DNS message for the domain name requested to be resolved in the DNS request, and send the mirror DNS message to the fraud blocking server. The fraud blocking server determines whether the mirror DNS message contains a fraud domain name through the domain name blacklist, for example, by comparing it with the domain name included in the domain name blacklist. If the domain name requested to be resolved in the mirror DNS message is included in the domain name blacklist, it means that the mirror DNS message contains a fraud domain name; otherwise, if the domain name requested to be resolved in the mirror DNS message is not included in the domain name blacklist, it means that the mirror DNS message package does not contain a fraud domain name. Among them, for example, the traffic detection server can specifically be the provincial network exit DPI data detection server in the above embodiment, and the embodiment is not limited to this.

[0090] The fraud-related domain name blocking system provided by the disclosed embodiment includes a fraud-related blocking server and a traffic detection server. The fraud-related blocking server can receive the blocking instruction sent by the superior anti-fraud platform, and generate a domain name blacklist according to the blocking instruction; when the traffic detection server obtains the DNS request sent by the terminal, it can generate a mirror DNS message based on the DNS request, and send the mirror DNS message to the fraud-related blocking server; the fraud-related blocking server determines whether the mirror DNS message is a fraud-related domain name through the generated domain name blacklist, and obtains the corresponding domain name resolution result. In this way, by setting up an independent fraud-related blocking server and detecting the mirror DNS message through the fraud-related blocking server, it is possible to avoid the need to occupy a separate cache through local DNS blocking, and the problem of decreased buffering performance and normal user perception caused by the increase in the blocking amount, thereby greatly improving the blocking efficiency of fraud-related domain names.

[0091] In the embodiment, when the mirror DNS message is a fraudulent domain name, the mirror DNS message is resolved into an empty domain name resolution result. This can avoid fraud caused by users visiting websites corresponding to fraudulent domain names, and achieve the purpose of blocking the set domain name. Alternatively, when the mirror DNS message is a non-fraudulent domain name, the mirror DNS message is resolved into the actual corresponding domain name resolution result, so that users can achieve normal access to websites corresponding to non-set domain names.

[0092] In an embodiment, the fraud blocking server is further used to send a domain name resolution result to the traffic detection server, and the domain name resolution result includes an empty domain name resolution result or an actual corresponding domain name resolution result.

[0093] The traffic detection server is also used to send domain name resolution results to the terminal.

[0094] The embodiment can realize the security protection of users by detecting the DNS request of the fraud blocking server. Regardless of whether the DNS request contains the fraud domain name, the domain name resolution result will be sent to the terminal on the user side to avoid the user waiting for a long time. Among them, when the DNS request contains the fraud domain name, an empty domain name resolution result will be returned. In this way, when the user accesses the empty domain name resolution result, a prompt page such as "The page does not exist" can be returned, or a related warning prompt page can be given, such as "The page you are visiting is an illegal page, please perform a security scan on the terminal device". When the fraud domain name is not included in the DNS request, the actual corresponding domain name resolution result can be given, so that the user can achieve normal access to the page or website.

[0095] In the embodiments provided by the present disclosure, in order to prevent users from circumventing supervision through active configuration, or performing passive configuration due to DNS hijacking, etc., there may be a situation where the local DNS or the domestic network is bypassed and access can continue. The embodiments can collect network traffic in the target area to determine whether the collected network traffic contains bypassed DNS requests, and perform fraud detection on these DNS requests.

[0096] Therefore, the traffic detection server is also used to collect network traffic in the target area and determine whether there is a DNS request in the collected data. When there is a DNS request in the collected data, a mirror DNS message is sent to the fraud blocking server based on the DNS request. In this way, the mirror DNS message can be detected by the fraud blocking server to determine whether it contains a fraud domain name. For details, please refer to the execution process of the above embodiment, which will not be repeated here.

[0097] In the embodiments provided by the present disclosure, in addition to generating or setting a domain name blacklist, a domain name whitelist can also be generated or set. For example, a fraud blocking server can receive important core domain names such as top-level domain names, second-level domain names, and government domain names sent by the superior anti-fraud platform, and generate a domain name whitelist based on these core domain names to prevent accidental blocking.

[0098] Therefore, the fraud blocking server is also used to receive core domain name information and generate a domain name whitelist based on the core domain name information.

[0099] The fraud blocking server is also used to determine whether the mirror DNS message is in the domain name whitelist. When the mirror DNS message is not in the whitelist, it is determined whether the mirror DNS message is a fraud domain name based on the domain name blacklist.

[0100] Alternatively, when the mirror DNS message is in the domain name whitelist, the mirror DNS message is resolved into the actual corresponding domain name resolution result.

[0101] In an embodiment, the fraud blocking server can first determine whether the domain name to be detected is in the domain name whitelist. If it is in the domain name whitelist, further detection and judgment through the domain name blacklist can be stopped; otherwise, if the domain name to be detected is not in the domain name whitelist, further detection and judgment can be performed through the domain name blacklist.

[0102] Based on the above embodiments, in another embodiment provided by the present disclosure, Figure 4 As shown, a method for blocking a fraudulent domain name is also provided. The method is applied to a fraudulent blocking server. The method may include the following steps:

[0103] In step S410, a blocking instruction is received, and a domain name blacklist is generated based on the blocking instruction.

[0104] In step S420, a mirror DNS message sent by the traffic detection server is received.

[0105] The mirror DNS message is generated based on the DNS request sent by the terminal.

[0106] In step S430, it is determined whether the mirror DNS message is a fraudulent domain name based on the domain name blacklist, and a corresponding domain name resolution result is obtained; wherein the domain name resolution result includes an empty domain name resolution result or a domain name resolution result actually corresponding to the mirror DNS message.

[0107] In the embodiment, the fraud blocking server can receive the blocking instruction sent from the anti-fraud platform, and generate a domain name blacklist based on the blocking instruction, and the domain name blacklist is the blacklist in the above embodiment. The traffic detection server in the embodiment can obtain the DNS request sent by the terminal, and generate a mirror DNS message for the domain name requested to be resolved in the DNS request, and send the mirror DNS message to the fraud blocking server. The fraud blocking server determines whether the mirror DNS message contains a fraud domain name through the domain name blacklist, for example, by comparing it with the domain name included in the domain name blacklist. If the domain name requested to be resolved in the mirror DNS message is included in the domain name blacklist, it means that the mirror DNS message contains a fraud domain name; otherwise, if the domain name requested to be resolved in the mirror DNS message is not included in the domain name blacklist, it means that the mirror DNS message package does not contain a fraud domain name. In this way, by setting up an independent fraud blocking server, the detection of the mirror DNS message can be realized through the fraud blocking server, which can avoid the problem of occupying a separate cache through local DNS blocking, and the buffering performance and user normal perception decrease caused by the increase in the blocking amount, thereby greatly improving the blocking efficiency of fraud domain names.

[0108] In the embodiment, when the mirror DNS message is a fraudulent domain name, the mirror DNS message can be resolved into an empty domain name resolution result. This can avoid fraud caused by users visiting websites corresponding to fraudulent domain names, and achieve the purpose of blocking the set domain name. Alternatively, when the mirror DNS message is a non-fraudulent domain name, the mirror DNS message is resolved into the actual corresponding domain name resolution result, so that users can achieve normal access to websites corresponding to non-set domain names.

[0109] In an embodiment, network traffic in the target area can also be collected, and it can be determined whether there is a DNS request in the collected data. When there is a DNS request in the collected data, a mirror DNS message is sent to the fraud blocking server based on the DNS request. In this way, the mirror DNS message can be detected to determine whether it contains a fraud-related domain name. When the mirror DNS message is a fraud-related domain name, the mirror DNS message can be resolved as an empty domain name resolution result.

[0110] In an embodiment, a domain name whitelist can also be generated based on core domain names, and the domain name to be detected can be first determined whether it is in the domain name whitelist. If it is in the domain name whitelist, further detection and judgment through the domain name blacklist can be stopped; otherwise, if the domain name to be detected is not in the domain name whitelist, further detection and judgment can be performed through the domain name blacklist.

[0111] In the case of dividing each functional module according to each function, the embodiment of the present disclosure provides a device for blocking a fraudulent domain name, which may be a server, a terminal, or a chip applied to a server. Figure 5 This is a schematic block diagram of the functional modules of a fraud-related domain name blocking device provided by an exemplary embodiment of the present disclosure. Figure 5 As shown, the fraudulent domain name blocking device includes:

[0112] A domain name blacklist generating module 10, configured to receive a blocking instruction and generate a domain name blacklist based on the blocking instruction;

[0113] A message receiving module 20, used to receive a mirror DNS message sent by a traffic detection server; wherein the mirror DNS message is generated based on a DNS request sent by a terminal;

[0114] The domain name resolution module 30 is used to determine whether the mirror DNS message is a fraudulent domain name based on the domain name blacklist, and obtain the domain name resolution result corresponding to the DNS request; wherein the domain name resolution result includes an empty domain name resolution result or a domain name resolution result actually corresponding to the mirror DNS message.

[0115] The fraud-related domain name blocking device provided by the embodiment of the present disclosure includes a fraud-related blocking server and a traffic detection server. The fraud-related blocking server can receive the blocking instruction sent by the superior anti-fraud platform, and generate a domain name blacklist according to the blocking instruction; when the traffic detection server obtains the DNS request sent by the terminal, it can generate a mirror DNS message based on the DNS request, and send the mirror DNS message to the fraud-related blocking server; the fraud-related blocking server determines whether the mirror DNS message is a fraud-related domain name through the generated domain name blacklist, and obtains the corresponding domain name resolution result. In this way, by setting up an independent fraud-related blocking server and detecting the mirror DNS message through the fraud-related blocking server, it is possible to avoid the need to occupy a separate cache through local DNS blocking, and the problem of decreased buffering performance and normal user perception caused by the increase in the blocking amount, thereby greatly improving the blocking efficiency of fraud-related domain names.

[0116] An embodiment of the present disclosure also provides an electronic device, comprising: at least one processor; and a memory for storing instructions executable by the at least one processor; wherein the at least one processor is configured to execute the instructions to implement the above method disclosed in the embodiment of the present disclosure.

[0117] Figure 6 The structure diagram of an electronic device provided by an exemplary embodiment of the present disclosure is shown in FIG. Figure 6 As shown, the electronic device 1800 includes at least one processor 1801 and a memory 1802 coupled to the processor 1801 , and the processor 1801 can execute corresponding steps in the above method disclosed in the embodiment of the present disclosure.

[0118] The processor 1801 may also be referred to as a central processing unit (CPU), which may be an integrated circuit chip having signal processing capabilities. Each step in the method disclosed in the embodiment of the present disclosure may be completed by an integrated logic circuit of hardware in the processor 1801 or by instructions in the form of software. The processor 1801 may be a general-purpose processor, a digital signal processor (DSP), an ASIC (Application Specific Integrated Circuit), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc. The steps of the method disclosed in the embodiment of the present disclosure may be directly embodied as being executed by a hardware decoding processor, or may be executed by a combination of hardware and software modules in a decoding processor. The software module may be located in a memory 1802, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, or other mature storage media in the art. The processor 1801 reads the information in the memory 1802 and completes the steps of the method in combination with its hardware.

[0119] In addition, when various operations / processes according to the present disclosure are implemented by software and / or firmware, they can be transmitted from a storage medium or a network to a computer system having a dedicated hardware structure, such as Figure 7 The computer system 1900 shown is installed with the programs constituting the software. When the various programs are installed, the computer system can perform various functions, including the functions described above. Figure 7 A structural block diagram of a computer system provided for an exemplary embodiment of the present disclosure.

[0120] Computer system 1900 is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Electronic devices can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0121] like Figure 7As shown, the computer system 1900 includes a computing unit 1901, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 1902 or a computer program loaded from a storage unit 1908 to a random access memory (RAM) 1903. In the RAM 1903, various programs and data required for the operation of the computer system 1900 can also be stored. The computing unit 1901, the ROM 1902, and the RAM 1903 are connected to each other via a bus 1904. An input / output (I / O) interface 1905 is also connected to the bus 1904.

[0122] A plurality of components in the computer system 1900 are connected to the I / O interface 1905, including: an input unit 1906, an output unit 1907, a storage unit 1908, and a communication unit 1909. The input unit 1906 may be any type of device capable of inputting information to the computer system 1900, and the input unit 1906 may receive input digital or character information, and generate key signal inputs related to user settings and / or function control of the electronic device. The output unit 1907 may be any type of device capable of presenting information, and may include, but is not limited to, a display, a speaker, a video / audio output terminal, a vibrator, and / or a printer. The storage unit 1908 may include, but is not limited to, a disk, an optical disk. The communication unit 1909 allows the computer system 1900 to exchange information / data with other devices over a network such as the Internet, and may include, but is not limited to, a modem, a network card, an infrared communication device, a wireless communication transceiver, and / or a chipset, such as a Bluetooth™ device, a WiFi device, a WiMax device, a cellular communication device, and / or the like.

[0123] The computing unit 1901 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 1901 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 1901 performs the various methods and processes described above. For example, in some embodiments, the above methods disclosed in the embodiments of the present disclosure may be implemented as a computer software program, which is tangibly included in a machine-readable medium, such as a storage unit 1908. In some embodiments, part or all of the computer program may be loaded and / or installed on an electronic device via ROM 1902 and / or communication unit 1909. In some embodiments, the computing unit 1901 may be configured to perform the above methods disclosed in the embodiments of the present disclosure in any other appropriate manner (e.g., by means of firmware).

[0124] The embodiment of the present disclosure further provides a computer-readable storage medium, wherein when instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the above method disclosed in the embodiment of the present disclosure.

[0125] The computer-readable storage medium in the disclosed embodiments may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. The computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. More specifically, the computer-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0126] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0127] The embodiments of the present disclosure further provide a computer program product, including a computer program, wherein when the computer program is executed by a processor, the above method disclosed in the embodiments of the present disclosure is implemented.

[0128] In embodiments of the present disclosure, computer program codes for performing the operations of the present disclosure may be written in one or more programming languages ​​or combinations thereof, including but not limited to object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code may be executed entirely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer.

[0129] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0130] The modules, components or units involved in the embodiments described in the present disclosure may be implemented by software or hardware, wherein the names of the modules, components or units do not, in some cases, limit the modules, components or units themselves.

[0131] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chip (SOCs), complex programmable logic devices (CPLDs), and the like.

[0132] The above descriptions are only some embodiments of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, a technical solution formed by replacing the above features with the technical features with similar functions disclosed in the present disclosure (but not limited to).

[0133] Although some specific embodiments of the present disclosure have been described in detail by way of example, it should be understood by those skilled in the art that the above examples are for illustration only and are not intended to limit the scope of the present disclosure. It should be understood by those skilled in the art that the above embodiments may be modified without departing from the scope and spirit of the present disclosure. The scope of the present disclosure is defined by the appended claims.

Claims

1. A system for blocking fraudulent domain names, characterized in that: The system comprises: A fraud blocking server, used to receive a blocking instruction and generate a domain name blacklist based on the blocking instruction; A traffic detection server, used to obtain a DNS request sent by a terminal, and send a mirror DNS message to the fraud blocking server based on the DNS request; The fraud blocking server is also used to receive the mirror DNS message sent by the traffic detection server, determine whether the mirror DNS message is a fraud-related domain name based on the domain name blacklist, and obtain the domain name resolution result corresponding to the DNS request.

2. The system according to claim 1, characterized in that The obtaining of the domain name resolution result corresponding to the DNS request includes: When the mirror DNS message is a fraudulent domain name, resolving the mirror DNS message into an empty domain name resolution result; Alternatively, when the mirror DNS message is a non-fraud-related domain name, the mirror DNS message is resolved into an actual corresponding domain name resolution result.

3. The system according to claim 2, characterized in that The fraud blocking server is further used to send a domain name resolution result to the traffic detection server; the domain name resolution result includes the empty domain name resolution result or the actual corresponding domain name resolution result; The traffic detection server is further used to send the domain name resolution result to the terminal.

4. The system according to claim 1, characterized in that The traffic detection server is also used to collect network traffic in the target area and determine whether there is a DNS request in the collected data. When a DNS request exists in the collected data, a mirror DNS message is sent to the fraud blocking server based on the DNS request.

5. The system according to claim 1, characterized in that The fraud blocking server is further used to receive core domain name information and generate a domain name whitelist based on the core domain name information; The fraud blocking server is further configured to determine whether the mirror DNS message is in the domain name whitelist, and when the mirror DNS message is not in the whitelist, determine whether the mirror DNS message is a fraud domain name based on the domain name blacklist; Alternatively, when the mirror DNS message is in the domain name whitelist, the mirror DNS message is resolved into an actually corresponding domain name resolution result.

6. A method for blocking fraudulent domain names, characterized in that: The method is applied to a fraud-related blocking server, and the method comprises: Receiving a blocking instruction, and generating a domain name blacklist based on the blocking instruction; Receiving a mirror DNS message sent by a traffic detection server; wherein the mirror DNS message is generated based on a DNS request sent by a terminal; Based on the domain name blacklist, determine whether the mirror DNS message is a fraud-related domain name, and obtain a corresponding domain name resolution result; wherein the domain name resolution result includes an empty domain name resolution result or a domain name resolution result actually corresponding to the mirror DNS message.

7. A device for blocking fraudulent domain names, characterized in that: The device is applied to a fraud blocking server, and the device comprises: A domain name blacklist generation module, used to receive a blocking instruction and generate a domain name blacklist based on the blocking instruction; A message receiving module, used to receive a mirror DNS message sent by a traffic detection server; wherein the mirror DNS message is generated based on a DNS request sent by a terminal; A domain name resolution module is used to determine whether the mirror DNS message is a fraudulent domain name based on the domain name blacklist, and obtain the domain name resolution result corresponding to the DNS request; wherein the domain name resolution result includes an empty domain name resolution result or a domain name resolution result actually corresponding to the mirror DNS message.

8. An electronic device, characterized in that: include: at least one processor; a memory for storing the at least one processor-executable instruction; The at least one processor is configured to execute the instructions to implement the method according to claim 6.

9. A computer-readable storage medium, characterized in that: When the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to perform the method as claimed in claim 6.

10. A computer program product, characterized in that The invention comprises a computer program, which implements the method of claim 6 when being executed by a processor.

Images