Network security protection method, electronic equipment, storage medium and program product

Abstract

The invention provides a network security protection method, electronic equipment, a storage medium and a program product, and relates to the field of computer network security, and the method comprises the steps: judging whether a received request message is a DNS message or not; if the received request message is a non-DNS message, judging whether the domain name of the non-DNS message hits a secure domain name database; if the received request message is a DNS message, judging whether the domain name of the DNS message hits a domain name blacklist or not; and determining whether to release the request message according to whether the safe domain name database or the domain name blacklist is hit. By identifying DNS messages and non-DNS messages and taking corresponding security measures, diversified network threats based on domain names are comprehensively defended.

Description

Technical Field

[0001] The present application relates to the field of computer network security, and more specifically, to a network security protection method, electronic device, storage medium, and program product. Background Art

[0002] With the development of the Internet, network security threats have become more complex and diverse. Domain names, as basic elements of the digital world, are often used as attack vectors. It is difficult for users to tell whether the domain name they are visiting is safe, so a dedicated protection system is needed to identify and defend against network threats based on domain names.

[0003] In the field of network security, the existing technology mainly protects network security by processing DNS (Domain Name System) messages, but does not consider other types of messages. The processing ability of non-DNS messages is limited, and it is difficult to adapt to diverse network threats, resulting in the inability to comprehensively defend against domain name-based network threats. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a network security protection method, electronic device, storage medium and program product, which can comprehensively defend against diversified network threats based on domain names by identifying DNS messages and non-DNS messages and taking corresponding security measures.

[0005] To achieve the above purpose, the technical solution adopted in the embodiment of the present application is as follows:

[0006] In a first aspect, an embodiment of the present application provides a network security protection method, including: determining whether a received request message is a DNS message; if the received request message is a non-DNS message, determining whether the domain name of the non-DNS message hits a security domain name database; if the received request message is a DNS message, determining whether the domain name of the DNS message hits a domain name blacklist; and determining whether to release the request message based on whether it hits the security domain name database or the domain name blacklist.

[0007] In one embodiment, before determining whether the received request message is a DNS message, the method further includes: receiving a request message sent by a user terminal; determining whether the security protection measures of the user terminal are enabled according to the protection policies corresponding to different users; if enabled, determining whether the received request message is a DNS message; if disabled, directly releasing the request message.

[0008] In one embodiment, before receiving the request message sent by the user terminal, the method further includes: generating security protection policies for different users in response to configuration information input by the administrator on the user management page.

[0009] In one embodiment, the determining whether the received request message is a DNS message includes: extracting and parsing the fields of the request message, determining whether the received message is a DNS message based on the parsing result of the fields, and extracting the domain name of the request message.

[0010] In one embodiment, determining whether to release the request message based on whether it hits the secure domain name database or the domain name blacklist includes: if it hits the secure domain name database, releasing the non-DNS message; if it does not hit the secure domain name database, discarding the non-DNS message.

[0011] In one embodiment, determining whether to release the request message according to whether it hits the secure domain name database or the domain name blacklist includes: if it hits the domain name blacklist, discarding the DNS message.

[0012] In one embodiment, determining whether to release the request message based on whether it hits the security domain name database or the domain name blacklist includes: if it does not hit the domain name blacklist, matching the domain name of the DNS message with a preset threat domain name rule library; and determining whether to release the request message based on the matching result.

[0013] In one embodiment, determining whether to release the request message based on the matching result includes: if the domain name of the DNS message fails to match the preset threat domain name rule library, determining that the domain name of the DNS message is a safe domain name, adding the domain name of the DNS message to the safe domain name database, and releasing the DNS message; if the domain name of the DNS message successfully matches the preset threat domain name rule library, determining that the domain name of the DNS message is a threat domain name, adding the domain name of the DNS message to the domain name blacklist, and discarding the DNS message.

[0014] In one embodiment, after determining whether to release the request message based on whether the secure domain name database or the domain name blacklist is hit, the method further includes: if the request message is not released, notifying the sender of the request message that a threatening domain name has been accessed.

[0015] In one embodiment, the method further includes: counting the number of times each user visits the threatening domain name; and marking a corresponding risk level for each user according to the number of times each user visits the threatening domain name.

[0016] According to a second aspect of the present application, there is provided an electronic device, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to execute the network security protection method described in the above embodiment.

[0017] According to a third aspect of the present application, a computer-readable storage medium is provided, wherein the storage medium stores a computer program, and the computer program can be executed by a processor to complete the network security protection method described in the above embodiment.

[0018] According to a fourth aspect of the present application, a computer program product is provided, including a computer program / instruction, which implements the network security protection method described in the above embodiment when executed by a processor.

[0019] According to the fifth aspect involved in the present application, a network security protection device is also provided, including: a message type judgment module, used to judge whether the received request message is a DNS message; a security domain name database judgment module, used to judge whether the domain name of the non-DNS message hits the security domain name database if the received request message is a non-DNS message; a domain name blacklist judgment module, used to judge whether the domain name of the DNS message hits the domain name blacklist if the received request message is a DNS message; a message release judgment module, used to determine whether to release the request message according to whether it hits the security domain name database or the domain name blacklist.

[0020] The network security protection method, electronic device, storage medium and program product provided in the above embodiments enhance the protection capability against various network threats by distinguishing between DNS messages and non-DNS messages and taking corresponding security measures. For DNS messages, by matching with the domain name blacklist, the domain name resolution process is optimized and the security protection efficiency is improved. For non-DNS messages, by matching with the security domain name database, the protection capability against other types of network threats is enhanced, thereby providing more comprehensive network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0022] Figure 1 A schematic diagram of an application scenario of a network security protection system provided in an embodiment of the present application;

[0023] Figure 2 A schematic diagram of a process flow of a network security protection method provided in an embodiment of the present application;

[0024] Figure 3 A schematic diagram of the process of receiving messages and determining protection strategies provided in an embodiment of the present application;

[0025] Figure 4 A schematic diagram of a process for generating security protection strategies for different users provided in an embodiment of the present application;

[0026] Figure 5 A detailed flowchart of a network security protection method provided in an embodiment of the present application;

[0027] Figure 6 A schematic diagram of the structure of a network security protection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0028] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0029] Figure 1 A schematic diagram of an application scenario of a network security protection system provided in an embodiment of the present application, such as Figure 1 As shown, the application scenario includes a user terminal device 110, a network security protection system 120 and the Internet 130. The user terminal device 110 is used to send a request message to the network security protection system 120, and the network security protection system 120 is used to detect and process the request message using the method provided in the following embodiment of the present application to determine whether to send the request message to the Internet 130, thereby improving network security. Figure 1 In the example, two user terminal devices 110 are used, but in fact, there is no limit on the number of user terminal devices 110. The user terminal device 110 can be a mobile phone, a tablet computer, a computer, etc.

[0030] Figure 2 A schematic diagram of a network security protection method provided in an embodiment of the present application is shown in FIG. Figure 2 As shown, the network security protection method includes the following steps S500-S610:

[0031] Step S500: Determine whether the received request message is a DNS message.

[0032] Specifically, the system (i.e., the network security protection system 120 mentioned above, hereinafter referred to as the system) identifies whether the received request message complies with the DNS protocol by analyzing the characteristics of the received request message, such as the port number and protocol type. This helps the system distinguish between DNS messages and non-DNS messages, thereby applying different processing rules to them. This ensures that the system can accurately classify DNS traffic and non-DNS traffic, providing an accurate starting point for subsequent security checks.

[0033] Step S510: If the received request message is a non-DNS message, determine whether the domain name of the non-DNS message hits the security domain name database.

[0034] Specifically, for non-DNS messages, the system will extract the domain name information and query the secure domain name database to determine whether the domain name is considered safe. The secure domain name database is a matching domain name comparison table, which refers to a pre-set database that contains a list of verified and considered safe domain names that are considered to contain no malicious content or threats. This step is designed to identify and allow requests to access known secure domain names. By quickly verifying the security of domain names in non-DNS messages, the system can efficiently release secure traffic and reduce interference with legitimate users.

[0035] Step S600: If the received request message is a DNS message, determine whether the domain name of the DNS message hits the domain name blacklist.

[0036] Specifically, if the received request message is a DNS message, the extracted domain name is compared with the built-in domain name blacklist. The domain name blacklist is a database containing known malicious or suspicious domain names that are associated with network attacks, phishing websites, or other security threats. This step effectively blocks DNS queries for known malicious or suspicious domain names, thereby preventing the network from being subject to security threats associated with these domain names. By directly matching with the domain name blacklist, there is no need to match the domain name with threat domain name rules every time, which improves the efficiency of threat domain name identification.

[0037] Step S610: Determine whether to release the request message based on whether it hits the secure domain name database or the domain name blacklist.

[0038] Specifically, the system will decide whether to release the request message based on the results of the first two steps. This decision-making step ensures that only network traffic that meets security standards can pass, thereby improving the overall security of the network and reducing the consumption of network resources by malicious traffic.

[0039] The technical solution provided by the above embodiment of the present application can provide security protection for both DNS request messages and non-DNS request messages, has strong reusability and is easy to expand. By matching with the domain name blacklist and the secure domain name database, the efficiency of security protection is improved and the performance of the device is improved.

[0040] In one embodiment, Figure 3 A flow chart of receiving messages and determining protection strategies provided in an embodiment of the present application is as follows: Figure 3 As shown, before determining whether the received request message is a DNS message in step S500, the following steps S300 to S420 are also included:

[0041] Step S300: Receive a request message sent by the user terminal.

[0042] Specifically, the system receives network request messages from the user end, which may include access requests to Internet resources, such as web browsing, file downloading, etc.

[0043] Step S400: judging whether the security protection measures of the user terminal are enabled according to the protection strategies corresponding to different users.

[0044] Specifically, query the matching ACL (Access Control List) policy to see if the ACL protection switch is turned on, that is, to determine whether the security protection measures on the user side are turned on, so as to determine whether the user who sent the request has enabled the network full protection measures. This step is completed by matching the user's IP address or other identifier with the record in the user management list. Among them, the ACL policy is a technology used to manage and control the access rights of users or systems to network resources in computer networks.

[0045] Step S410: If it is on, execute step S500 to determine whether the received request message is a DNS message.

[0046] Specifically, if the protection switch is turned on, the user's access to the network will be detected and processed by the system, and the system will execute Figure 2 A safety check is further performed according to the steps shown in the corresponding embodiment.

[0047] Step S420: If it is closed, directly release the request message.

[0048] Specifically, if the protection switch is turned off, the system will directly release the user's request message without performing a security check on the message content, and the user will be fully allowed to access the network without restriction.

[0049] Users can choose whether to enable security protection according to their needs, providing a more flexible and personalized security solution. For requests that do not require security checks, the system can quickly release them, improving the user's network access experience. Among them, the protection switch is turned on by default and can be turned off manually.

[0050] In one embodiment, Figure 4 A schematic diagram of a process for generating security protection strategies for different users provided in an embodiment of the present application, such as Figure 4 As shown, before step S300 receives the request message sent by the user terminal, it also includes:

[0051] Step S200: In response to the configuration information input by the administrator on the user management page, generate security protection policies for different users.

[0052] Specifically, administrators can input and update user configuration information, including user name, IP address, email address, and protection switch status, through the user management page. The system will dynamically generate and adjust personalized security protection policies for different users based on these inputs to ensure that access to network resources meets the specific security needs and protection levels of each user, thereby achieving refined network security management.

[0053] For example, the administrator first adds users to the user list through the user management page. The configuration added to the user list includes the user's name (required), IP (required), email (required), and whether to enable the security protection function (required). Subsequently, the system will display a user list containing user name, IP, email, protection switch and risk level, which enhances the visual management of user information and enables administrators to quickly understand and monitor the user's status and security settings.

[0054] The risk level is initially set to "healthy" by default, and will be dynamically adjusted to "low", "medium" or "high" based on the number of times the user visits the threat domain name. This allows security protection to respond more accurately to the user's security status and adjust protection measures in a timely manner. Administrators can also add, modify, delete and clear user lists, which simplifies administrator management operations and allows flexible management of user security configurations. Furthermore, only mailboxes and protection switches are allowed to be modified, which reduces the risk of misoperation while maintaining the security and integrity of user information.

[0055] After the user completes the configuration, the system will automatically deploy access ACL policies based on the user's personalized settings to ensure that the implementation of network security protection matches user needs.

[0056] Specifically, for those users who have enabled security protection, the system will automatically issue ACL policies containing security protection measures. These policies will monitor and filter the network traffic of these users to prevent potential domain name threats. For example, if user Zhang San has enabled the security protection switch in his personal settings, the system will issue him an ACL containing security protection rules, which will block access to known malicious domain names and take corresponding protective measures when threats are detected.

[0057] Conversely, for users who choose to turn off the security protection feature, the system will issue an ACL policy that does not include security protection measures. This means that the network traffic of these users will not be subject to additional security checks, allowing them to freely access the Internet without being restricted by the domain name threat protection system. For example, if user Li Si chooses to turn off the security protection switch, the system will issue him a normal ACL and will not perform security checks on the domain names he accesses.

[0058] In some embodiments, step S500 determines whether the received request message is a DNS message, specifically including: extracting and parsing the fields of the request message, determining whether the received message is a DNS message based on the parsing results of the fields, and extracting the domain name of the request message.

[0059] Specifically, for each request message, the AI ​​protocol parsing and identification module extracts key fields, such as the port number (DNS usually uses port 53), protocol type (UDP or TCP), and other features of the message header. The extracted fields, especially the port number, are parsed to determine whether the message meets the characteristics of the DNS protocol.

[0060] If the message meets the standards of the DNS protocol, such as containing the correct query or response format and the appropriate port number (usually port 53), the AI ​​module will identify it as a DNS message. If the message does not meet the standards of the DNS protocol, it will be judged as a non-DNS message.

[0061] At the same time, the domain name of the user request message is extracted. This step is not only applicable to DNS messages, but also to non-DNS messages, such as HTTP and HTTPS requests. For example, for DNS messages, since DNS messages have a standardized structure, including a header, a question part, an answer part, an authority part, and an additional part, where the question part contains the queried domain name, the queried domain name is directly extracted from the question part. For non-DNS messages, such as HTTP requests, the system will parse the URL (Uniform Resource Locator) to extract the domain name.

[0062] The design of the AI ​​protocol parsing and identification module is highly flexible and versatile. The module is not limited to a specific type of AI protocol parsing technology, but adopts an open architecture that can adapt to and learn different protocol features and adapt to the parsing needs of multiple protocols and data formats, including but not limited to key information of network messages such as port numbers, protocol types, and IP addresses.

[0063] Enabling the AI ​​protocol parsing and identification module not only improves the efficiency and accuracy of DNS message identification and enhances network security protection, but it can also be easily extended to other functions for reuse. This flexibility allows the system to easily integrate new protocol identification or network traffic analysis tasks in the future without having to develop new modules from scratch, thereby saving development time and costs, speeding up the deployment of new functions, and providing a solid foundation for other future technology upgrades and functional expansions.

[0064] For example, user Zhangsan enters a URL http: / / example.com in his browser and tries to access it. After obtaining the request message, by extracting and parsing the fields of the request message, it is found that its target port is 53, and the protocol type meets the characteristics of DNS query, so it is determined that the request message is a DNS message. At the same time, the domain name example.com is parsed from the DNS query message.

[0065] Figure 5 Detailed flowchart of a network security protection method provided by an embodiment of the present application. Figure 5 As shown, the network security protection method includes the following steps S100-S900:

[0066] Step S100: The configuration information entered by the administrator on the user management page includes the user name, IP address, email address, and protection switch status.

[0067] Step S200: In response to the configuration information input by the administrator on the user management page, generate security protection policies for different users.

[0068] Step S300: Receive a request message sent by the user terminal.

[0069] Step S400: According to the protection strategies corresponding to different users, determine whether the security protection measures of the user end are turned on. If it is turned on, execute step S500 to determine whether the received request message is a DNS message. If it is turned off, execute step S420 to directly release the request message.

[0070] Step S500: Determine whether the received request message is a DNS message.

[0071] Step S510: If the received request message is a non-DNS message, it is determined whether the domain name of the non-DNS message hits the secure domain name database. If not, step S511 is executed; if yes, step S512 is executed.

[0072] Step S511: If the secure domain name database is not hit, the non-DNS message is discarded.

[0073] Step S512: If the secure domain name database is hit, the non-DNS message is released.

[0074] Specifically, if the received message is a non-DNS message, it is checked whether the domain name carried in the non-DNS message is recorded in the security domain name database.

[0075] If the domain name in the non-DNS message matches an entry in the secure domain name database, indicating that the domain name is credible, the system will perform a release operation, allowing the non-DNS message to continue its network transmission process. This design ensures that legal and secure network communications will not be blocked without reason, thereby maintaining network efficiency and users' normal Internet experience.

[0076] On the contrary, if the domain name in the non-DNS message is not in the secure domain name database, that is, no record is hit, the system will take preventive measures to automatically discard the non-DNS message to prevent potential malware, phishing attacks or other network threats from entering the network.

[0077] This mechanism can effectively reduce network security risks and improve the overall security of the network without affecting normal network communications. At the same time, it also reflects the flexibility and intelligence of the system in processing non-DNS messages, and can dynamically adjust protection measures according to the latest security information.

[0078] Step S600: If the received request message is a DNS message, determine whether the domain name of the DNS message hits the domain name blacklist. If it hits, execute step S611; if not, execute step S700.

[0079] Step S611: If the domain name blacklist is hit, the DNS message is discarded.

[0080] Specifically, if the domain name of the DNS message hits the blacklist, the message is directly discarded to prevent domain name resolution requests that may cause security risks and protect the network from known threats.

[0081] Step S700: If the domain name blacklist is not hit, the domain name of the DNS message is matched with the preset threat domain name rule library; if the match fails, step S800 is executed; if the match succeeds, step S710 is executed.

[0082] When a domain name is not on the blacklist, the existing technology will not further identify and process the domain name, thus failing to identify and protect against domain names that have not yet been flagged as known threats but may still pose risks. This leads to a significant security vulnerability, making network systems vulnerable to new or not widely recognized cyber threats, and making it impossible to fully protect against domain-based cyber threats.

[0083] In some embodiments of the present application, specifically, if the domain name of the DNS message does not hit the domain name blacklist, the request will not be released immediately, but step S700 will be further executed to match the domain name with the preset threat domain name rule library. This threat domain name rule library contains a series of security rules and patterns for identifying potential threat domain names, which may not have been widely identified as malicious, but show certain suspicious characteristics. Through this in-depth analysis, more potential threats can be identified and blocked, and the domain name blacklist and rule library can be dynamically adjusted according to the constantly updated threat intelligence to achieve timely response to emerging threats. Then, based on the matching results with the threat domain name rule library, decide whether to release the request message.

[0084] Step S800: If the domain name of the DNS message fails to match the preset threat domain name rule library, the domain name of the DNS message is determined to be a safe domain name, the domain name of the DNS message is added to the safe domain name database, the DNS message is released, and step S900 is executed.

[0085] Step S900: Add the IP and domain name in the DNS response packet in the previous step to the secure domain name database and forward the message.

[0086] Specifically, after receiving the corresponding DNS response packet, the IP address and domain name information contained in the response packet are added to the secure domain name database. The secure domain name database records the correspondence between the domain name and the server IP, which helps the system to process similar DNS requests more efficiently in the future.

[0087] The DNS response packet is forwarded to ensure that the requester's query operation is completed. At the same time, the system's ability to manage network traffic is enhanced by updating the secure domain name database. This coherent process not only ensures the smooth resolution of legitimate domain names, but also strengthens the system's dynamic defense mechanism against network threats.

[0088] Step S710: If the domain name of the DNS message successfully matches the preset threat domain name rule library, the domain name of the DNS message is determined to be a threat domain name, and the domain name of the DNS message is added to the domain name blacklist;

[0089] Step S711: Notify the sender of the request message that the threat domain name has been accessed.

[0090] Step S712: discard the DNS message.

[0091] Specifically, the domain name of the DNS message is matched with the preset threat domain name rule library. If the domain name of the DNS message fails to match the threat domain name rule library, the domain name of the DNS message is determined to be a safe domain name, the DNS message will be released, and the normal domain name resolution process is allowed to continue.

[0092] If the domain name of the DNS message successfully matches the threat domain name rule base, it indicates that the domain name is a threat domain name. The domain name is added to the domain name blacklist to ensure that all future requests to the domain name will be automatically blocked. When other users try to access the blacklisted threat domain name, there is no need to repeat the domain name security comparison. Instead, the access request to the domain name is quickly blocked based on the records in the domain name blacklist. This optimization measure not only improves the response speed, but also reduces the system burden, ensuring the efficiency and effectiveness of network security protection. The DNS message is discarded to prevent any further communication attempts. If the request message is not released, the sender of the request message is notified that the threat domain name has been accessed.

[0093] Specifically, if a request message is judged as not to be released for security reasons, a variety of notification methods will be used to inform the user of the request message that the domain name it is trying to access has been identified as a threat domain name by the system. In addition to sending email notifications, warnings can also be sent to users through SMS, in-app push notifications, instant messaging messages, or system log prompts. This instant feedback mechanism enables users to promptly perceive the network security risks they may be exposed to, thereby improving their security awareness and prompting them to take action to avoid potential security threats, further enhancing the security of the entire network environment.

[0094] In some embodiments, the network security protection method in the above embodiments may further include: counting the number of times each user visits the threatening domain name; and marking a corresponding risk level for each user according to the number of times each user visits the threatening domain name.

[0095] Specifically, in addition to basic domain name filtering and access control, it can also count the number of times each user visits a domain name identified as a threat, ensuring real-time tracking and analysis of user behavior. By counting the number of times a user visits a threatening domain name, it is possible to quantitatively assess the network security risk of each user. Based on the frequency with which the user visits the threatening domain name, the system assigns a corresponding risk level to each user. The risk level can be preset, such as "low", "medium", and "high", corresponding to different levels of security risk. This grading system helps system and network administrators quickly identify which users may face higher security risks and take corresponding preventive measures.

[0096] Furthermore, the network security protection method of any of the above embodiments may also include: implementing differentiated security policies according to the risk level of the user. For example, for users with higher risk levels, the monitoring of their network access is strengthened, and their access to certain high-risk websites is restricted, or users are required to perform additional identity verification before accessing certain websites. Such measures are intended to reduce network security incidents that may be caused by high-risk users.

[0097] Through this comprehensive user behavior statistics and risk assessment mechanism, not only the pertinence and effectiveness of network security protection are improved, but also users' awareness of network security is enhanced, promoting the security and stability of the entire network environment.

[0098] In a specific embodiment, the process of implementing network security protection is as follows:

[0099] The administrator adds a list of users who have security protection enabled. Taking Zhang San as an example, the administrator enters the following information: name Zhang San, IP address 192.168.10.10, email address zhangsan@XXXX.com.cn, and selects to turn on the security protection switch.

[0100] After the user information is configured, the system automatically generates and applies an ACL policy. The source address of this ACL is the user's IP address (192.168.10.10), and the security protection function is enabled. At the same time, the system's AI application identification module also starts running, preparing to parse and identify network traffic.

[0101] Zhang San tries to access a threat domain name in the browser, for example: http: / / s-tech.hu.

[0102] After receiving the network request message sent by Zhang San, it first matches the corresponding ACL and confirms that the protection switch is on. Then, the AI ​​module parses the message, recognizes that it is a DNS query message, and extracts the target domain name (s-tech.hu).

[0103] The extracted domain name is matched with the existing domain name blacklist. Since this is the first access, the domain name has not been included in the blacklist, so the match fails.

[0104] Next, the domain name is compared with the threat domain name rule library, and it is found that the domain name does exist in the threat domain name rule library, that is, the threat domain name is hit.

[0105] This domain name is added to the domain name blacklist and the message is immediately discarded to prevent Zhang San from accessing the threatening domain name. At the same time, the system will automatically send an email to notify Zhang San that he has accessed a threatening domain name.

[0106] The administrator checks the user list on the user management page and finds that Zhang San's risk level has changed from the default "healthy" to "low". The administrator can clearly see the threat domains Zhang San has visited and the corresponding risk level changes, which is convenient for subsequent management and tracking.

[0107] In another specific embodiment, the process of implementing network security protection is as follows:

[0108] The administrator adds a list of users who have security protection enabled. Taking Li Si as an example, the administrator enters the following information: name is Li Si, IP address is 192.168.20.20, email address is lisi@XXXX.com.cn, and selects to turn on the security protection switch.

[0109] After the user information is configured, the system automatically generates and applies an ACL policy. The source address of this ACL is the user's IP address (192.168.20.20), and the security protection function is enabled. At the same time, the system's AI application identification module also starts running, preparing to parse and identify network traffic.

[0110] Li Si tries to access an HTTP resource in the browser, for example: http: / / example.com.

[0111] After receiving the network request message sent by Li Si, it first matches the corresponding ACL and confirms that the protection switch is on. Then, the AI ​​module parses the message and recognizes that it is a non-DNS query message.

[0112] Match the domain name (example.com) in the extracted URL against a secure domain name database.

[0113] If the domain name is found to be in the secure domain name database, the domain name is considered to be a secure domain name, and the message request is allowed to pass, and the user can access it normally.

[0114] The administrator checks the user list through the user management page and finds that Li Si's risk level is still "healthy" because the domain name visited this time is a secure domain name.

[0115] Based on the network security protection method provided in any of the above embodiments and based on the same inventive concept, an embodiment of the present application provides a network security protection device 1000 to implement the above network security protection method. Figure 6 A schematic diagram of the structure of a network security protection device provided in an embodiment of the present application is shown in FIG. Figure 6 As shown, the network security protection device 1000 of the embodiment of the present application at least includes: a message type judgment module 1001, a security domain name database judgment module 1002, a domain name blacklist judgment module 1003, and a message release judgment module 1004, wherein:

[0116] The message type determination module 1001 is used to determine whether the received request message is a DNS message.

[0117] The secure domain name database determination module 1002 is used to determine whether the domain name of the non-DNS message hits the secure domain name database if the received request message is a non-DNS message.

[0118] The domain name blacklist determination module 1003 is used to determine whether the domain name of the DNS message hits the domain name blacklist if the received request message is a DNS message.

[0119] The message release judgment module 1004 is used to determine whether to release the request message according to whether it hits the security domain name database or the domain name blacklist.

[0120] The specific execution process of each of the above modules can be found in the corresponding steps of the method section, which will not be repeated here.

[0121] An embodiment of the present application also provides an electronic device, which may include a processor and a memory for storing instructions executable by the processor, and the processor is configured to implement the steps of the network security protection method of any of the above embodiments.

[0122] An embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. The computer program can be executed by a processor to complete the steps of the network security protection method of any of the above embodiments.

[0123] An embodiment of the present application also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the network security protection method of any of the above embodiments.

[0124] In summary, the technical solution provided by the embodiment of the present invention has the following advantages:

[0125] Administrators only need to configure the user management list, and the system will automatically issue security policies, simplifying management work, reducing human errors, and speeding up response.

[0126] By clearly identifying users who access threatening domain names, timely and effective intervention can be carried out. Through the notification mechanism of accessing threatening domain names, there is a clear perception of accessing threatening domain names, which enhances users' network security awareness and enables users to understand the security of their own network activities in real time.

[0127] It adopts AI application identification module, has powerful network traffic identification capabilities, and provides flexibility for future functional expansion.

[0128] By adding threat domain names to the blacklist, subsequent access requests can be quickly blocked, repeated checks can be avoided, and performance and system response speed can be significantly improved.

[0129] By conducting in-depth analysis of each domain name, it not only relies on blacklist matching, but also combines the preset threat domain name rule library to identify potential threats and dynamically adjust the blacklist and rule library to ensure timely response to emerging threats.

[0130] In the embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely illustrative.

[0131] It should be noted that if the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can essentially be embodied in the form of a software product, or in other words, the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM) random access memory (RAM), disk or optical disk, and other media that can store program codes.

[0132] The above are only embodiments of the present application and are not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the scope of protection of the present application.

Claims

1. A network security protection method, characterized in that: include: Determine whether the received request message is a DNS message; If the received request message is a non-DNS message, determine whether the domain name of the non-DNS message hits the secure domain name database; If the received request message is a DNS message, determine whether the domain name of the DNS message hits the domain name blacklist; Whether to release the request message is determined according to whether it hits the secure domain name database or the domain name blacklist.

2. The method according to claim 1, characterized in that Before determining whether the received request message is a DNS message, the method further includes: Receive the request message sent by the user end; According to the protection strategies corresponding to different users, determine whether the security protection measures of the user end are enabled; If it is enabled, it will determine whether the received request message is a DNS message; If it is closed, the request message is directly released.

3. The method according to claim 2, characterized in that Before receiving the request message sent by the user terminal, the method further includes: In response to the configuration information entered by the administrator on the user management page, security protection policies are generated for different users.

4. The method according to claim 1, characterized in that: The determining whether the received request message is a DNS message includes: The fields of the request message are extracted and parsed, and it is determined whether the received message is a DNS message according to the parsing result of the fields, and the domain name of the request message is extracted.

5. The method according to claim 1, characterized in that The determining whether to release the request message according to whether the secure domain name database or the domain name blacklist is hit includes: If the secure domain name database is hit, the non-DNS message is released; if the secure domain name database is not hit, the non-DNS message is discarded.

6. The method according to claim 1, characterized in that The determining whether to release the request message according to whether the secure domain name database or the domain name blacklist is hit includes: If the domain name blacklist is hit, the DNS message is discarded.

7. The method according to claim 1, characterized in that The determining whether to release the request message according to whether the secure domain name database or the domain name blacklist is hit includes: If the domain name blacklist is not hit, the domain name of the DNS message is matched with a preset threat domain name rule library; According to the matching result, it is determined whether to release the request message.

8. The method according to claim 7, characterized in that The determining, according to the matching result, whether to release the request message comprises: If the domain name of the DNS message fails to match the preset threat domain name rule library, the domain name of the DNS message is determined to be a safe domain name, the domain name of the DNS message is added to the safe domain name database, and the DNS message is released; If the domain name of the DNS message successfully matches the preset threat domain name rule library, the domain name of the DNS message is determined to be a threat domain name, the domain name of the DNS message is added to the domain name blacklist, and the DNS message is discarded.

9. The method according to claim 1, characterized in that: After determining whether to release the request message according to whether the secure domain name database or the domain name blacklist is hit, the method further includes: If the request message is not released, the sender of the request message is notified that the threat domain name is accessed.

10. The method according to claim 1, characterized in that The method further comprises: Count the number of times each user visits the threat domain name; According to the number of times each user visits the threat domain name, each user is marked with a corresponding risk level.

11. An electronic device, characterized in that: The electronic device comprises: processor; a memory for storing processor-executable instructions; Wherein, the processor is configured to execute the network security protection method described in any one of claims 1-10.

12. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and the computer program can be executed by a processor to complete the network security protection method described in any one of claims 1-10.

13. A computer program product, characterized in that It includes a computer program / instruction, which, when executed by a processor, implements the network security protection method described in any one of claims 1-10.

Images