Safety access control method and system for DNS (Domain Name Server) analysis

Abstract

The invention discloses a security access control method and system oriented to DNS (Domain Name Server) analysis, and relates to the technical field of network security, and the method comprises the steps: collecting DNS data, carrying out the preprocessing, and calculating the dynamic spectrum intensity based on the preprocessed DNS data; calculating the threat degree based on the dynamic spectrum intensity, constructing a long-short-term memory network model, predicting the future threat degree, and drawing a threat degree trend curve; and constructing a visual interface to display a threat degree trend curve, and storing, collecting and analyzing the generated DNS data. A dimension reduction feature matrix is generated through a multi-scale embedding technology and a nonlinear dimension reduction method, rapid detection and protection of potential network threats are achieved, the capability of preventing potential network attacks is improved, the threat degree is calculated in combination with nonlinear dynamic weighting, the sensitivity to complex attack behaviors is enhanced, the recognition precision of DNS traffic abnormal behaviors is improved, and the method is suitable for popularization and application. And the occurrence probability of security vulnerabilities is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a secure access control method and system oriented to DNS resolution. Background Art

[0002] With the widespread application of the Internet and the rapid development of information technology, network security has become a key issue of global concern. Domain Name System (DNS), as one of the basic services of the Internet, is responsible for resolving domain names into IP addresses and is a key component of network communication. DNS services have also exposed many security risks during their widespread application. DNS attacks occur frequently, especially malicious behaviors such as DNS cache poisoning, DNS amplification attacks, and data transmission through DNS tunnels. These attacks not only threaten users' network security, but also make the systems of enterprises and service providers face greater security risks. The security issues of DNS are becoming increasingly prominent. In order to improve the security of DNS services, researchers and network security experts have proposed various security protection solutions based on traffic analysis and behavior monitoring, which usually rely on detailed analysis of the characteristics of DNS requests in network traffic to improve the accuracy of attack detection.

[0003] Although existing technologies have made certain progress in DNS traffic analysis and anomaly detection, there are still many shortcomings. DNS traffic analysis technology often relies on static rules or simple statistical methods, which are easily affected by environmental changes and difficult to cope with highly complex attack modes. Existing threat assessments usually only rely on simple threshold judgments and lack real-time monitoring and detailed analysis of dynamic changes in traffic, resulting in high false alarm and missed alarm rates. Summary of the invention

[0004] In view of the above existing problems, the present invention is proposed.

[0005] Therefore, the present invention provides a secure access control method and system for DNS resolution, which solves the problem that the analysis technology of DNS traffic in the prior art often relies on static rules or simple statistical methods, is easily affected by environmental changes, and is difficult to cope with highly complex attack modes. The existing threat assessment usually only relies on simple threshold judgment, lacks real-time monitoring and detailed analysis of dynamic changes in traffic, resulting in a high false alarm rate and missed alarm rate.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions: In a first aspect, the present invention provides a security access control method for DNS resolution, which includes collecting and preprocessing DNS data, calculating dynamic spectrum intensity based on the preprocessed DNS data; calculating the threat level based on the dynamic spectrum intensity, constructing a long short-term memory network model to predict the future threat level and draw a threat level trend curve; constructing a visual interface to display the threat level trend curve, and storing, collecting and analyzing the generated DNS data.

[0007] As a preferred solution of the DNS resolution-oriented security access control method of the present invention, wherein: the collecting and preprocessing of DNS data refers to using a traffic monitoring tool to collect and preprocess the DNS data in the network traffic; The DNS data includes timestamp, latency, request size, and request frequency; The preprocessing includes using the NTP protocol to unify the time of the collected DNS data, using a hash algorithm to perform a deduplication operation, using an interpolation method to fill in missing data, and normalizing the DNS data.

[0008] As a preferred solution of the DNS resolution-oriented security access control method of the present invention, wherein: the calculation of dynamic spectrum intensity based on pre-processed DNS data refers to extracting the time window using the time window feature extraction method based on the pre-processed DNS data. The features of all time windows are stacked into a time series feature matrix. ; Based on the time series feature matrix , using the Gaussian function to define the embedding function , where a is the embedding dimension index Compute embedding function Gradient ; Based on embedded function and gradient Combine and calculate the Gaussian kernel embedding value , the formula is: ,in For embedded centers; For the time series feature matrix Perform wavelet transform to extract frequency domain components , generate the frequency domain component matrix; The phase angle of the frequency component is calculated using the Fast Fourier Transform based on each column of the frequency domain component matrix. , where u is the index of the frequency component; Gaussian kernel embedding , frequency domain components and the phase angle , use multi-scale embedding technology to perform nonlinear dimensionality reduction on the time series feature matrix to generate a reduced dimensionality feature matrix , the formula is: , Where M is the number of frequency components and k is the number of embedding scales; Calculate the Euclidean distance between data points using the Euclidean distance method based on the reduced dimension feature matrix ,in and is the data point, l and j are the indexes of the data point; Use the nearest neighbor radius method to set the number of nearest neighbors L and calculate the distance from each data point to the Lth nearest neighbor. , calculate the local reachable density based on the density estimation of the nearest neighbor distance Based on local reachability density , using the density ratio method to calculate the local anomaly factor ; Calculate the local outlier factor The mean of is set as the abnormal threshold , using the ratio analysis method to calculate the time window The proportion of abnormal points ; Use the percentile method to set the judgment threshold, compare the abnormal point ratio with the judgment threshold, mark the abnormal point ratio greater than the judgment threshold as an abnormal window, and generate an abnormal point set; The abnormal window features are extracted from the abnormal point set using the time window feature extraction method, and the features of all abnormal windows are stacked into a traffic matrix; Use standard quantum state representation to map the flow matrix into quantum states

[0009] For quantum states Superposition is performed to obtain the comprehensive state ; Comprehensive Perform measurements and extract the contribution of characteristic frequencies ; Based on the columns in the traffic matrix, piecewise linear interpolation is performed using linear interpolation to obtain the eigenvalue at time t. ; Contribution based on characteristic frequency and the eigenvalues ​​at time t Perform weighted summation to calculate the dynamic spectrum intensity at time t , the formula is: , where m is the total number of features.

[0010] As a preferred solution of the DNS resolution-oriented security access control method of the present invention, wherein: the threat degree calculated based on the dynamic spectrum intensity refers to the dynamic spectrum intensity based on time t Each time point is defined as a node in the graph, and the edge weight is calculated according to the difference in dynamic spectrum intensity between time points. The edge weight greater than 0 is screened out to construct a dynamic spectrum graph; Filter out edge weights greater than 0 and define them as neighborhood sets. Calculate the sum of the edge weights in the neighborhood set to get the total neighborhood weight. Use the proportional distribution calculation method to calculate the importance distribution of nodes in the neighborhood in the dynamic spectrum graph. The local topological entropy is calculated using Shannon entropy, and the mean of the local topological entropy is set as the benchmark , calculate the local topological entropy change by subtracting the topological entropy change from the baseline , where o is a node The index of Based on the change of local topological entropy , using nonlinear dynamic weighting to calculate the threat level of the node , the formula is: , Use the percentile method to set the judgment threshold, and compare the threat level with the judgment threshold. If the threat level is greater than or equal to the judgment threshold, it is judged as a high threat, the analysis is rejected, and an error response is returned. If the threat level is less than the judgment threshold, it is judged as a low threat, the analysis is allowed, and an early warning is issued and recorded in the access log.

[0011] As a preferred solution of the DNS resolution-oriented security access control method of the present invention, wherein: the construction of the long short-term memory network model to predict the future threat level and draw the threat level trend curve refers to collecting historical DNS data with labels and preprocessing them, using weighted fusion to calculate the historical threat level, and generating a training set; The long short-term memory network model is constructed, including input layer, hidden layer and fully connected output layer; Set the input layer to threat level; Use the training set to train the LSTM network model, and use the loss function and Adam optimizer to iteratively optimize the model parameters; Input the threat level of the node into the trained long short-term memory network model to predict the future threat level; Sort the future threat levels by time t and use Matplotlib to draw the threat level trend curve.

[0012] As a preferred solution of the DNS resolution-oriented security access control method of the present invention, wherein: the construction of a visual interface to display the threat trend curve refers to using the front-end framework React to construct a visual interface, including a main chart area and a top information bar; Display the threat trend curve in the main chart area and the threat level in the top information bar; Users who have passed real-name verification are allowed to view the information.

[0013] As a preferred solution of the DNS resolution-oriented security access control method described in the present invention, the storage of the DNS data collected and analyzed refers to storing the collected DNS data and the threat trend curve generated by the analysis in a central database, and setting security access measures. The central database backs up the stored data in the cloud, and regularly performs integrity checks on the stored data and the backup data. After the test is completed, an integrity test record is generated and synchronously stored in the central database.

[0014] In a second aspect, the present invention provides a secure access control system for DNS resolution, comprising: A collection and calculation module is used to collect and pre-process DNS data, and calculate the dynamic spectrum intensity based on the pre-processed DNS data; The threat construction module is used to calculate the threat level based on the dynamic spectrum intensity, build a long short-term memory network model to predict the future threat level and draw a threat level trend curve; The visualization storage module is used to build a visualization interface to display the threat trend curve and store the DNS data collected and analyzed.

[0015] In a third aspect, the present invention provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program is executed by the processor, any step of the secure access control method for DNS resolution as described in the first aspect of the present invention is implemented.

[0016] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of the secure access control method for DNS resolution as described in the first aspect of the present invention.

[0017] The beneficial effects of the present invention are as follows: the present invention collects DNS data and performs preprocessing, calculates the dynamic spectrum intensity based on the preprocessed DNS data; calculates the threat level based on the dynamic spectrum intensity, constructs a long short-term memory network model to predict the future threat level and draws a threat level trend curve; improves the recognition accuracy of abnormal DNS traffic behavior, reduces the probability of security vulnerabilities, and enhances the ability to prevent potential network attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0019] Figure 1 This is a flowchart of the secure access control method for DNS resolution in Example 1.

[0020] Figure 2 This is a structural diagram of the secure access control system for DNS resolution in Example 1. DETAILED DESCRIPTION

[0021] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

[0022] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0023] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0024] Example 1, reference Figure 1 and Figure 2 , which is the first embodiment of the present invention, and provides a secure access control method for DNS resolution, comprising the following steps: S1, collect and preprocess DNS data, and calculate dynamic spectrum intensity based on the preprocessed DNS data; Specifically, collecting DNS data and preprocessing it means using a traffic monitoring tool to collect DNS data in network traffic and preprocessing it; The DNS data includes timestamp, latency, request size, and request frequency; The preprocessing includes using the NTP protocol to unify the time of the collected DNS data, using a hash algorithm to perform a deduplication operation, using an interpolation method to fill in missing data, and normalizing the DNS data.

[0025] In the process of collecting DNS data, due to the possible clock deviation of different network devices, the inconsistency of timestamps will lead to errors in data analysis. By using the NTP protocol to unify the timestamps, not only the time difference between devices is eliminated, but also the time synchronization of DNS data in analysis is ensured, which improves the accuracy of data analysis. In particular, when performing time series feature extraction and anomaly detection, the interference caused by time synchronization problems is avoided. Through the hash algorithm to deduplicate, it can ensure that each DNS request and response is only counted once in the analysis, thereby improving data processing efficiency and reducing the waste of computing resources. The interpolation method can restore the coherence of the data, reduce the analysis errors caused by missing data, and further improve the robustness of the system. Normalization can not only improve the efficiency of the algorithm, but also enhance the generalization ability of the analysis model, so that it can more accurately identify various abnormal behaviors and security threats.

[0026] Furthermore, anomaly detection analysis based on the preprocessed DNS data refers to extracting the time window using the time window feature extraction method based on the preprocessed DNS data. Features ,in , and The time windows The mean of request latency, mean of request size, and total number of requests, i is the index of the time window, and the features of all time windows are stacked into a time series feature matrix ; Based on the time series feature matrix , using the Gaussian function to define the embedding function , the formula is: , in To embed the center, is the width of the embedding function, a is the embedding dimension index; Compute embedding function Gradient , the formula is: , Based on embedded function and gradient Combine and calculate the Gaussian kernel embedding value , the formula is: , Time series data usually has nonlinear and local characteristics. Linear dimensionality reduction methods (such as PCA) cannot capture these complex patterns. The Gaussian kernel function can capture the similarity of local areas in the time series through nonlinear mapping. The time series may contain multiple scales. The kernel width of the Gaussian kernel function can capture the characteristics of different scales. Although other kernel methods (such as polynomial kernels) can capture nonlinear relationships, they are less sensitive to distance and lack flexible adaptation to multiple scales. High-variance areas in time series may cause excessive interference to the embedding results. Traditional embedding techniques (such as linear weighting) usually rely on manually setting the weights of feature points, while gradient adjustment automatically adjusts the embedding value according to the rate of change of feature points to avoid subjectivity. Gradient modulus adjustment dynamically balances the contribution of high-variance areas and low-variance areas by measuring the rate of change of feature points. The importance of feature points is dynamically adjusted through gradient modulus and logarithmic compression to avoid the subjectivity and noise amplification problems of traditional weight allocation. For the time series feature matrix Perform wavelet transform to extract frequency domain components , generate the frequency domain component matrix; The phase angle of the frequency component is calculated using the Fast Fourier Transform based on each column of the frequency domain component matrix. ; Gaussian kernel embedding , frequency domain components and the phase angle , use multi-scale embedding technology to perform nonlinear dimensionality reduction on the time series feature matrix to generate a reduced dimensionality feature matrix , the formula is: , where M is the number of frequency components, k is the number of embedding scales, and u is the index of the frequency component; Time series data usually contains noise. Wavelet transform can suppress noise and enhance the stability of features during decomposition. It can weight frequency components to highlight the main frequency features while suppressing the interference of secondary frequency features. Normalization ensures the balance of feature components by adjusting the relative weights of different frequency components. Compared with direct normalization, the introduction of amplitude and phase joint processing enhances the expression ability of frequency components, suppresses the contribution of low-amplitude and high-noise components, and enhances the robustness of dimensionality reduction results. Wavelet transform has good resolution in both time and frequency space. Compared with Fourier transform, it can better describe the local characteristics of time series. Through square sum normalization, it reduces the influence of amplitude differences of different frequency components and enhances the stability of embedding results. The introduction of phase angle and sine-cosine weighting mechanism enhances the ability to distinguish frequency components while avoiding the dominance of low-frequency components on the results. Gaussian kernel function combined with multi-scale analysis can capture the details and trend characteristics in time series, making the embedding results more robust. Calculate the Euclidean distance between data points using the Euclidean distance method based on the reduced dimension feature matrix ,in and is the data point, l and j are the indexes of the data point; Use the nearest neighbor radius method to set the number of nearest neighbors L and calculate the distance from each data point to the Lth nearest neighbor. , calculate the local reachable density based on the density estimation of the nearest neighbor distance , the formula is: ,in For data points The L-nearest neighbor set of ; Based on local reachability density , using the density ratio method to calculate the local anomaly factor , the formula is: , Calculate the local outlier factor The mean of is set as the abnormal threshold , using the ratio analysis method to calculate the time window The proportion of abnormal points , the formula is: , Use the percentile method to set the judgment threshold, compare the abnormal point ratio with the judgment threshold, mark the abnormal point ratio greater than the judgment threshold as an abnormal window, and generate an abnormal point set; The abnormal window features are extracted from the abnormal point set using the time window feature extraction method, and the features of all abnormal windows are stacked into a traffic matrix; Use standard quantum state representation to map the flow matrix into quantum states , the formula is: , Where m is the total number of features, is the characteristic value, is an orthogonal basis of feature j; For quantum states Superposition is performed to obtain the comprehensive state , the formula is: , Where n is the total number of time windows; Comprehensive Perform measurements and extract the contribution of characteristic frequencies , the formula is: , Based on the columns in the traffic matrix, piecewise linear interpolation is performed using linear interpolation to obtain the eigenvalue at time t. ; Contribution based on characteristic frequency and the eigenvalues ​​at time t Perform weighted summation to calculate the dynamic spectrum intensity at time t , the formula is: .

[0027] By dividing the DNS data into different time windows, the feature extraction method can analyze the traffic characteristics in each time period and capture the timing changes in DNS requests. The Gaussian function helps to reduce the impact of noise through its smoothing characteristics, ensure the stability of the data during the embedding process, enhance the analyzability of the data, and ensure that the system accurately captures abnormal traffic. By extracting frequency domain features, it can reveal periodic changes and potential attack patterns in DNS traffic. Multi-scale embedding technology can significantly improve the data expression ability after dimensionality reduction by capturing the nonlinear relationship and multi-level characteristics of the data. The quantum state representation and weighted summation methods can achieve efficient information compression and enhanced feature extraction by quantizing the traffic data. The weighted summation further enhances the sensitivity to frequency contribution and time characteristics, enabling the system to accurately calculate the dynamic spectrum intensity and further improve the detection and response capabilities of security threats.

[0028] S2. Calculate the threat level based on the dynamic spectrum intensity, build a long short-term memory network model to predict the future threat level and draw a threat level trend curve; Specifically, the threat level calculated based on the dynamic spectrum intensity refers to the dynamic spectrum intensity based on time t Each time point is defined as a node in the graph, and the edge weight is calculated according to the difference in dynamic spectrum intensity between time points. The edge weight greater than 0 is screened out to construct a dynamic spectrum graph; Filter out edge weights greater than 0 and define them as neighborhood sets. Calculate the sum of the edge weights in the neighborhood set to get the total neighborhood weight. Use the proportional distribution calculation method to calculate the importance distribution of nodes in the neighborhood in the dynamic spectrum graph. The local topological entropy is calculated using Shannon entropy, and the mean of the local topological entropy is set as the benchmark , calculate the local topological entropy change by subtracting the topological entropy change from the baseline , where o is a node The index of Based on the change of local topological entropy , using nonlinear dynamic weighting to calculate the threat level of the node , the formula is: , Use the percentile method to set the judgment threshold, and compare the threat level with the judgment threshold. If the threat level is greater than or equal to the judgment threshold, it is judged as a high threat, the analysis is rejected, and an error response is returned. If the threat level is less than the judgment threshold, it is judged as a low threat, the analysis is allowed, and an early warning is issued and recorded in the access log.

[0029] The change of local topological entropy directly reflects the important characteristics of the complexity and degree of change of local structure, and quantifies the topological relationship between nodes and neighborhoods. This characteristic cannot be completely replaced by other simple features (such as degree centrality, path length, etc.). The node relationship in the dynamic spectrum graph changes over time, and the local topological entropy can capture this change characteristic. Especially when dealing with the heterogeneity of the graph, it is more sensitive than a single global feature (such as global entropy or network density). It introduces the combination of local and global information. The local topological entropy provides fine-grained node features, and the baseline enhances the ability to compare anomalies. In the existing technology, local features usually use simple weighted centrality or neighborhood statistics, but do not use the nonlinear measurement characteristics of topological entropy. In the graph structure, the local topological entropy may have extremely high or low values. High values ​​are smoothed by logarithmic functions to avoid excessive values ​​dominating the threat degree calculation. The existing technology usually uses linear weighting to process local eigenvalues, lacking sensitivity control over extreme values. The exponential function can dynamically amplify the contribution of nodes with large entropy changes to the threat degree, thereby making abnormal nodes more prominent in the calculation. In the existing technology, the calculation of threat degree usually uses a simple linear accumulation or multiplication model, lacking effective control over extreme values. This formula reasonably balances the contribution of high and low values ​​to the results through fractional form. The fractional design also introduces nonlinear complexity, making the formula more adaptable to different feature distributions. Through the combination of logarithmic and exponential functions, the processing ability of extreme values ​​and highly sensitive features is enhanced, avoiding the common problem of calculation result bias in the existing technology; By constructing a dynamic spectrum graph based on the spectrum intensity difference between time points, the system can convert complex time series data into a graph structure, making the change pattern in DNS traffic more intuitive. The combination of Shannon entropy and local topological entropy can more accurately capture the complexity of traffic and its abnormal fluctuations when analyzing DNS traffic. This combined analysis can more comprehensively identify potential threats, especially in complex network environments, and can sensitively detect subtle changes in attack behaviors. The nonlinear dynamic weighting method can accurately assess the threat level of each node by weighting the changes in local topological entropy. Unlike traditional linear weighting, the nonlinear weighting method can adapt to the complex nonlinear relationship in the data and improve the accuracy of threat level assessment. The automated threat response mechanism greatly improves the efficiency of network defense and avoids the lag and error of manual intervention. The threat level calculation method based on dynamic spectrum graph and local topological entropy provides the system with a real-time assessment of the security status of DNS traffic. The level of threat level determines the response strategy of the system. By setting a threshold judgment mechanism, the system can detect abnormal traffic in a timely manner and respond quickly, reducing the false alarm rate and missed alarm rate, so that the system can maintain efficient and accurate threat detection when facing different traffic scales and network changes.

[0030] Furthermore, constructing a long short-term memory network model to predict future threat levels and drawing a threat level trend curve refers to collecting and preprocessing historical DNS data with labels, using weighted fusion to calculate historical threat levels, and generating a training set; The long short-term memory network model is constructed, including input layer, hidden layer and fully connected output layer; Set the input layer to threat level; Use the training set to train the LSTM network model, and use the loss function and Adam optimizer to iteratively optimize the model parameters; Input the threat level of the node into the trained long short-term memory network model to predict the future threat level; Sort the future threat levels by time t and use Matplotlib to draw the threat level trend curve.

[0031] Label data refers to DNS data that has been labeled with real threat situations. By analyzing and preprocessing these data, the model can learn the relationship between threat level and DNS traffic characteristics. Different time points or different types of DNS data may have different degrees of impact on threat level prediction. Through weighted fusion, the system can more accurately identify and process these data, especially when facing unbalanced or noisy data, it can reduce the model error and improve the accuracy of prediction. After receiving the historical threat level input of the node, the LSTM model can automatically extract the potential patterns and trends in the historical data through multi-level time feature modeling. By using the Adam optimizer, the LSTM model can adaptively adjust the learning rate of each parameter during the training process and quickly converge to the optimal solution. By sorting the future threat level predicted by LSTM by time and using Matplotlib to draw the trend curve, the system can intuitively show the changes in future threat levels. By analyzing the fluctuations of the trend curve, the security team can promptly identify possible attack modes or abnormal traffic changes, and then take corresponding defense measures. By continuously tracking the changes in threat level, the system can provide data support for the formulation of network security strategies to ensure that security protection always keeps up with changes in threat situations.

[0032] S3, build a visual interface to display the threat trend curve, store the DNS data collected and analyzed; Specifically, building a visual interface to display the threat trend curve refers to using the front-end framework React to build a visual interface, including a main chart area and a top information bar; Display the threat trend curve in the main chart area and the threat level in the top information bar; Users who have passed real-name verification are allowed to view the information.

[0033] The React framework makes the display of threat trend curves more dynamic. Users can monitor the changes in network security threats in real time through an intuitive interface. Through the dynamically drawn trend curve, users can quickly understand the fluctuations in future threat levels and make corresponding response strategies. This not only improves the readability of the data, but also provides decision-making support for security managers, helping them to predict potential network security issues. By displaying the value or graph of the threat level in real time in the information bar, users can quickly understand the current network security status and discover potential threat problems in a timely manner. Real-name verification ensures system access control and protects the security of sensitive data. The real-name verification system can effectively prevent data from being viewed or tampered with by unauthorized users, ensuring the implementation of network security protection measures.

[0034] Furthermore, storing the DNS data generated by collection and analysis means storing the collected DNS data and the threat trend curve generated by the analysis in a central database, and setting security access measures. The central database will back up the stored data in the cloud, and regularly perform integrity checks on the stored data and backup data. After the test is completed, an integrity test record will be generated and stored synchronously in the central database.

[0035] By storing and analyzing DNS data, real-time tracking, backtracking and historical comparison can be performed in subsequent network security monitoring, so as to better identify potential attack behaviors and trend changes. Strict security control measures are taken for access to the central database to effectively prevent data leakage, tampering and unauthorized access. Cloud backup provides reliable redundant storage for DNS data and threat trend curves. Even if local storage fails, data can be restored from the cloud. Through cloud backup, the system can maintain business continuity and avoid serious consequences caused by data loss. By comparing the hash value or checksum of the data, the integrity of the data is checked to ensure the accuracy and credibility of the data. The integrity detection record is part of the log and can be used for investigation of security incidents such as system troubleshooting and malicious attack analysis.

[0036] This embodiment also provides a secure access control system for DNS resolution, including: A collection and calculation module is used to collect and pre-process DNS data, and calculate the dynamic spectrum intensity based on the pre-processed DNS data; The threat construction module is used to calculate the threat level based on the dynamic spectrum intensity, build a long short-term memory network model to predict the future threat level and draw a threat level trend curve; The visualization storage module is used to build a visualization interface to display the threat trend curve and store the DNS data collected and analyzed.

[0037] This embodiment also provides a computer device, which is applicable to the security access control method for DNS resolution, including: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute computer-executable instructions to implement the security access control method for DNS resolution proposed in the above embodiment.

[0038] The computer device may be a terminal, and the computer device includes a processor, a memory, a communication interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. The display screen of the computer device may be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device may be a touch layer covered on the display screen, or a key, trackball or touchpad provided on the housing of the computer device, or an external keyboard, touchpad or mouse, etc.

[0039] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, the method for implementing secure access control for DNS resolution as proposed in the above embodiment is implemented; the storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable red-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, disk or optical disk.

[0040] In summary, the present invention collects and preprocesses DNS data, calculates the dynamic spectrum intensity based on the preprocessed DNS data; calculates the threat level based on the dynamic spectrum intensity, constructs a long short-term memory network model to predict the future threat level and draws a threat level trend curve; improves the recognition accuracy of abnormal DNS traffic behavior, reduces the probability of security vulnerabilities, and enhances the ability to prevent potential network attacks.

[0041] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A secure access control method for DNS resolution, characterized by: include, Collect and pre-process DNS data, and calculate dynamic spectrum intensity based on the pre-processed DNS data; The threat level is calculated based on the dynamic spectrum intensity, and a long short-term memory network model is constructed to predict the future threat level and draw a threat level trend curve; Build a visual interface to display the threat trend curve and store the DNS data collected and analyzed.

2. The secure access control method for DNS resolution according to claim 1, characterized in that: The collecting and preprocessing of DNS data refers to using a traffic monitoring tool to collect and preprocess DNS data in network traffic; The DNS data includes timestamp, latency, request size, and request frequency; The preprocessing includes using the NTP protocol to unify the time of the collected DNS data, using a hash algorithm to perform a deduplication operation, using an interpolation method to fill in missing data, and normalizing the DNS data.

3. The secure access control method for DNS resolution as claimed in claim 2, characterized in that: The calculation of dynamic spectrum intensity based on the pre-processed DNS data refers to extracting the time window using the time window feature extraction method based on the pre-processed DNS data. The features of all time windows are stacked into a time series feature matrix. ; Based on the time series feature matrix , using the Gaussian function to define the embedding function , where a is the embedding dimension index; Compute embedding function Gradient ; Based on embedded function and gradient Combine and calculate the Gaussian kernel embedding value , the formula is: ,in For embedded centers; For the time series feature matrix Perform wavelet transform to extract frequency domain components , generate the frequency domain component matrix; The phase angle of the frequency component is calculated using the Fast Fourier Transform based on each column of the frequency domain component matrix. , where u is the index of the frequency component; Embedding values ​​based on Gaussian kernel , frequency domain components and the phase angle , use multi-scale embedding technology to perform nonlinear dimensionality reduction on the time series feature matrix to generate a reduced dimensionality feature matrix , the formula is: , where M is the number of frequency components and k is the number of embedding scales; Calculate the Euclidean distance between data points using the Euclidean distance method based on the reduced dimension feature matrix ,in and is the data point, l and j are the indexes of the data point; Use the nearest neighbor radius method to set the number of nearest neighbors L and calculate the distance from each data point to the Lth nearest neighbor. , calculate the local reachable density based on the density estimation of the nearest neighbor distance ; Based on local reachability density , using the density ratio method to calculate the local anomaly factor ; Calculate the local outlier factor The mean of is set as the abnormal threshold , using the ratio analysis method to calculate the time window The proportion of abnormal points ; Use the percentile method to set the judgment threshold, compare the abnormal point ratio with the judgment threshold, mark the abnormal point ratio greater than the judgment threshold as an abnormal window, and generate an abnormal point set; The abnormal window features are extracted from the abnormal point set using the time window feature extraction method, and the features of all abnormal windows are stacked into a traffic matrix; Use standard quantum state representation to map the flow matrix into quantum states ; For quantum states Superposition is performed to obtain the comprehensive state ; Comprehensive Perform measurements and extract the contribution of characteristic frequencies ; Based on the columns in the traffic matrix, piecewise linear interpolation is performed using linear interpolation to obtain the eigenvalue at time t. ; Contribution based on characteristic frequency and the eigenvalues ​​at time t Perform weighted summation to calculate the dynamic spectrum intensity at time t , the formula is: , where m is the total number of features.

4. The secure access control method for DNS resolution as claimed in claim 3, characterized in that: The threat level calculated based on the dynamic spectrum intensity refers to the dynamic spectrum intensity based on time t. Each time point is defined as a node in the graph, and the edge weight is calculated according to the difference in dynamic spectrum intensity between time points. The edge weight greater than 0 is screened out to construct a dynamic spectrum graph; Filter out edge weights greater than 0 and define them as neighborhood sets. Calculate the sum of the edge weights in the neighborhood set to get the total neighborhood weight. Use the proportional distribution calculation method to calculate the importance distribution of nodes in the neighborhood in the dynamic spectrum graph. The local topological entropy is calculated using Shannon entropy, and the mean of the local topological entropy is set as the benchmark , calculate the local topological entropy change by subtracting the topological entropy change from the baseline , where o is a node The index of Based on the change of local topological entropy , using nonlinear dynamic weighting to calculate the threat level of the node , the formula is: , Use the percentile method to set the judgment threshold, and compare the threat level with the judgment threshold. If the threat level is greater than or equal to the judgment threshold, it is judged as a high threat, the analysis is rejected, and an error response is returned. If the threat level is less than the judgment threshold, it is judged as a low threat, the analysis is allowed, and an early warning is issued and recorded in the access log.

5. The secure access control method for DNS resolution as claimed in claim 4, characterized in that: The constructing of the long short-term memory network model to predict the future threat level and draw the threat level trend curve refers to collecting and preprocessing the historical DNS data with labels, using weighted fusion to calculate the historical threat level, and generating a training set; The long short-term memory network model is constructed, including input layer, hidden layer and fully connected output layer; Set the input layer to threat level; Use the training set to train the LSTM network model, and use the loss function and Adam optimizer to iteratively optimize the model parameters; Input the threat level of the node into the trained long short-term memory network model to predict the future threat level; Sort the future threat levels by time t and use Matplotlib to draw the threat level trend curve.

6. The secure access control method for DNS resolution as claimed in claim 5, characterized in that: The said constructing a visual interface to display the threat trend curve refers to using the front-end framework React to construct a visual interface, including a main chart area and a top information bar; Display the threat trend curve in the main chart area and the threat level in the top information bar; Users who have passed real-name verification are allowed to view the information.

7. The secure access control method for DNS resolution according to claim 6, characterized in that: The storage of the DNS data collected and generated by the analysis refers to storing the collected DNS data and the threat trend curve generated by the analysis in a central database, and setting security access measures. The central database will back up the stored data in the cloud, and regularly perform integrity checks on the stored data and backup data. After the test is completed, an integrity test record will be generated and stored synchronously in the central database.

8. A secure access control system for DNS resolution, based on the secure access control method for DNS resolution according to any one of claims 1 to 7, characterized in that: include, A collection and calculation module is used to collect and pre-process DNS data, and calculate the dynamic spectrum intensity based on the pre-processed DNS data; The threat construction module is used to calculate the threat level based on the dynamic spectrum intensity, build a long short-term memory network model to predict the future threat level and draw a threat level trend curve; The visualization storage module is used to build a visualization interface to display the threat trend curve and store the DNS data collected and analyzed.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the secure access control method for DNS resolution described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the secure access control method for DNS resolution described in any one of claims 1 to 7 are implemented.

Images