DNS tunnel detection method, device, electronic device and storage medium

Abstract

The present application relates to the field of network security technology, and in particular to a DNS tunnel detection method, device, electronic device and storage medium. A first resolution request and a second resolution request are sent to an authoritative domain name server. A first response result and a second response result are received from the authoritative domain name server. When the first response result and the second response result are different, a first test data packet is sent to a first IP address and a second test data packet is sent to a second IP address. A first lifetime value of the first test data packet and a second lifetime value of the second test data packet are received. When the first lifetime value and the second lifetime value are greater than or equal to a first threshold value, it is determined that a DNS tunnel exists between the first client and the authoritative domain name server. The above scheme can detect DNS tunnels in a timely manner and improve the accuracy of detecting DNS tunnels.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a DNS tunnel detection method, device, electronic device, and storage medium. Background Art

[0002] Domain Name System (DNS) tunneling is a method of establishing communication by encapsulating other protocols within the DNS protocol. Because the DNS protocol is a fundamental and essential network service, most firewalls and intrusion detection devices do not intercept or filter DNS traffic, making it a powerful tool for covert communication. Attackers can exploit this to establish remote control channels for botnets and Trojans, as well as to transmit data externally. Therefore, the detection of DNS tunneling technology is a key focus in the field of network security.

[0003] Currently, there are two main approaches to detecting DNS tunneling. The first method involves obtaining DNS request traffic, analyzing the characteristics of the domain name to be resolved, and using a model to determine whether a DNS tunnel exists. However, this method requires accumulating a certain number of request domain names before analysis can be performed, resulting in a certain delay. By the time this method determines whether a DNS tunnel exists, the compromised client may have already completed sending important data. Furthermore, detection accuracy depends on the degree of fit between the model and the data. Because the characteristics of the domain name to be resolved represented by the attacker's terminal may change continuously, the detection model must be continuously adjusted.

[0004] The second method compares DNS traffic response data with actual user network access traffic to identify abnormal traffic. However, the accuracy of this method depends on collecting sufficient DNS traffic and user network access data. Sufficient traffic data must be collected before analysis can be performed. This method also has a certain lag, making it difficult to detect abnormalities in communication in a timely manner. Summary of the Invention

[0005] Embodiments of the present application provide a DNS tunnel detection method, device, electronic device, and storage medium for timely detecting DNS tunnels and improving the detection accuracy of DNS tunnels.

[0006] In a first aspect, an embodiment of the present application provides a DNS tunnel detection method, in which a first resolution request and a second resolution request are sent to an authoritative domain name server. The first resolution request includes a first domain name. The second resolution request includes the first domain name. The first resolution request and the second resolution request are used to instruct the authoritative domain name server to resolve the first domain name. A first response result and a second response result are received from the authoritative domain name server. The first response result includes the first domain name and a first Internet Protocol IP address corresponding to the first domain name, and the second response result includes the first domain name and a second IP address corresponding to the first domain name. If the first response result and the second response result are different, a first test data packet is sent to the first IP address and a second test data packet is sent to the second IP address. A first lifetime value of the first test data packet and a second lifetime value of the second test data packet are received. If the first lifetime value and the second lifetime value are greater than or equal to a first threshold, it is determined that a DNS tunnel exists between the first client and the authoritative domain name server.

[0007] In the above method, compared with the existing technology that detects DNS tunnels by collecting a certain amount of user network access traffic data, the present application can detect DNS tunnels in a timely manner through the first response result and the second response result returned by the authoritative domain name server, saving the cost of network traffic collection. When detecting the DNS tunnel, the present application can also interfere with the communication between the attacker's remote control terminal and the first client through the DNS tunnel by sending the first resolution request and the second resolution request. At the same time, the present application occupies less processing resources, can improve the detection capability of DNS tunnels in internal and external operating networks, and enhance network security, which is of great significance to network security.

[0008] Optionally, the number of response results of the authoritative domain name server to the first client in the first time period is determined in the query record. The query record is used to store resolution requests from multiple client IP addresses and response results from the authoritative domain name server corresponding to the resolution requests. The multiple client IP addresses include the first client IP address. Sending the first resolution request and the second resolution request to the authoritative domain name server specifically includes: when the number is greater than or equal to a third threshold, sending the first resolution request and the second resolution request to the authoritative domain name server.

[0009] In the above method, compared with the existing technology that only caches the response results in the query record, the present application caches both the resolution requests from multiple client IP addresses and the response results from the authoritative domain name server corresponding to the resolution requests in the query record, so as to facilitate timely determination of whether it is necessary to detect the DNS tunnel based on the number of response results of the authoritative domain name server to the first client in the query record, thereby improving network security.

[0010] Optionally, the first domain name is the domain name with the largest number among the domain names included in each resolution request from the first client IP address in the first time period.

[0011] In the above method, by taking the domain name with the largest number among the domain names contained in each resolution request from the first client IP address within the first time period as the first domain name, it is convenient to subsequently send the first resolution request containing the first domain name and the second resolution request containing the first domain name to the authoritative domain name server, so as to detect the DNS tunnel in time.

[0012] Optionally, when the first IP address and the second IP address are the same, it is determined that no DNS tunnel exists between the first client and the authoritative domain name server.

[0013] In the above method, when the first IP address and the second IP address are the same, it is determined that no DNS tunnel exists between the first client and the authoritative domain name server, and the DNS tunnel is detected in time to improve network security and enhance user experience.

[0014] Optionally, when the first lifetime value and the second lifetime value are less than a first threshold, it is determined that no DNS tunnel exists between the first client and the authoritative domain name server.

[0015] In the above method, when the first lifetime value and the second lifetime value are less than the first threshold, it is determined that no DNS tunnel exists between the first client and the authoritative domain name server, and the DNS tunnel is detected in time to improve network security and enhance user experience.

[0016] Optionally, when the first response result and / or the second response result includes indication information for indicating that the domain name resolution fails, it is determined that a DNS tunnel exists between the first client and the authoritative domain name server.

[0017] In the above method, when the first response result and / or the second response result contains indication information for indicating that the domain name resolution failed, it is determined that a DNS tunnel exists between the first client and the authoritative domain name server, and the DNS tunnel is detected in time to improve network security, detection accuracy and user experience.

[0018] Optionally, after determining that a DNS tunnel exists between the first client and the authoritative domain name server, the sending of the resolution request to the authoritative domain name server is stopped.

[0019] In the above method, after determining that a DNS tunnel exists between the client and the authoritative domain name server, the resolution request to the authoritative domain name server is stopped, thereby disconnecting the connection with the DNS tunnel and stopping the resolution of the authoritative domain name server, thereby forming a strong protection for the first client and improving network security.

[0020] In a second aspect, an embodiment of the present application provides a DNS tunnel detection device, including:

[0021] a transceiver module, configured to send a first resolution request and a second resolution request to an authoritative domain name server; wherein the first resolution request includes the first domain name, the second resolution request includes the first domain name, and the first resolution request and the second resolution request are used to instruct the authoritative domain name server to resolve the first domain name;

[0022] The transceiver module is further configured to receive a first response result and a second response result from the authoritative domain name server; the first response result includes the first domain name and a first Internet Protocol IP address corresponding to the first domain name, and the second response result includes the first domain name and a second IP address corresponding to the first domain name;

[0023] The transceiver module is further configured to send a first test data packet to the first IP address and a second test data packet to the second IP address when the first response result and the second response result are different;

[0024] The transceiver module is further configured to receive a first lifetime value of a first test data packet and a second lifetime value of a second test data packet;

[0025] The processing module is configured to determine that a DNS tunnel exists between the first client and the authoritative domain name server when the first lifetime value and the second lifetime value are greater than or equal to a first threshold.

[0026] In a third aspect, an embodiment of the present application further provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the processor implements any one of the DNS tunnel detection methods described in the first aspect above.

[0027] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, any one of the DNS tunnel detection methods of the first aspect is implemented.

[0028] In a fifth aspect, an embodiment of the present application further provides a computer program product, including a computer program, which is executed by a processor to implement any one of the DNS tunnel detection methods in the first aspect above.

[0029] The technical effects brought about by any implementation method in the second to fifth aspects can refer to the technical effects brought about by the corresponding implementation method in the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1A schematic diagram of an application scenario of a DNS tunnel detection method provided in an embodiment of the present application;

[0031] Figure 2 A flow chart of a DNS tunnel detection method provided in an embodiment of the present application;

[0032] Figure 3 A schematic diagram of a query record provided in an embodiment of the present application;

[0033] Figure 4 An exemplary flow chart of a DNS tunnel detection provided in an embodiment of the present application;

[0034] Figure 5 A schematic diagram of a device for DNS tunnel detection provided in an embodiment of the present application;

[0035] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0036] To make the objectives, technical solutions, and advantages of this application more clear, this application will be further described in detail below with reference to the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making any creative efforts are within the scope of protection of this application.

[0037] The application scenarios described in the embodiments of this application are intended to more clearly illustrate the technical solutions of the embodiments of this application and do not constitute a limitation on the technical solutions provided by the embodiments of this application. Persons skilled in the art will appreciate that, as new application scenarios emerge, the technical solutions provided by the embodiments of this application are equally applicable to similar technical problems. In the description of this application, unless otherwise specified, "multiple" means two or more.

[0038] Currently, there are two main approaches to detecting DNS tunnels. The first method is to obtain DNS request traffic, analyze the characteristics of the domain name to be resolved, and use a model to determine whether a DNS tunnel exists. However, this method requires a certain number of request domain names to be accumulated before analysis can be performed, which results in a certain lag. The second method is to compare the response data in the DNS traffic with the user's actual network access traffic to identify abnormal traffic. However, the accuracy of this method depends on whether a sufficient amount of DNS traffic and user network access data is collected. Sufficient traffic data must be collected before analysis can be performed, and there is also a certain lag. Therefore, how to detect DNS tunnels in a timely manner is a question worth discussing.

[0039] To address the above-mentioned issues, embodiments of the present application provide a DNS tunnel detection method. For example, a first resolution request and a second resolution request are sent to an authoritative domain name server. The first resolution request includes a first domain name. The second resolution request includes a second domain name. The first and second domain names are the same. The first resolution request instructs the authoritative domain name server to resolve the first domain name. The second resolution request instructs the authoritative domain name server to resolve the second domain name. A first response and a second response are received from the authoritative domain name server. The first response includes the first domain name and a first Internet Protocol (IP) address corresponding to the first domain name. The second response includes the second domain name and a second IP address corresponding to the second domain name. If the first and second responses differ, a first test packet is sent to the first IP address and a second test packet is sent to the second IP address. A first time-to-live value of the first test packet and a second time-to-live value of the second test packet are received. If the first time-to-live value and the second time-to-live value are greater than or equal to a first threshold, it is determined that a DNS tunnel exists between the first client and the authoritative domain name server. This method allows for timely DNS tunnel detection, improves the accuracy of DNS tunnel detection, and provides users with better network services and an enhanced user experience.

[0040] The following is an introduction to DNS recursive queries:

[0041] There are two common ways to identify a host: by hostname and by Internet Protocol address (IP address). Hostnames are easy for humans to use and remember, such as www.baidu.com. IP addresses, on the other hand, are a set of numbers processed by the computer's internal binary system, such as 192.168.1.34. Domain name resolution is the process of associating an IP address with a domain name. DNS is a system that performs bidirectional translation, allowing humans to communicate with hosts and vice versa.

[0042] DNS is a naming system for computers and network services organized into a domain hierarchy. As a distributed database that maps domain names to IP addresses, the DNS facilitates internet access. When a client initiates an online request and there is no corresponding resolution record in the client's cache, the client initiates a resolution request to the local domain name server. The local domain name server first queries its local query records. If there is a query record for the domain name, it directly returns the IP address corresponding to the domain name to the client. If there is no query record for the domain name, the local domain name server will, on behalf of the client, perform a recursive query to the root domain name server, top-level domain name server, and second-level domain name server. Finally, it finds the IP address corresponding to the domain name, obtains the result, returns it to the client, and saves the record in the local query record. If the client initiates another query request within the Time To Live (TTL) value, the local domain name server will directly send the result to the client without initiating another global query.

[0043] like Figure 1 As shown, a schematic diagram of an application scenario of an optional DNS tunnel detection method according to an embodiment of the present application includes a client 101, a local domain name server 102, and an authoritative domain name server 103. A communication connection can be established between the client 101 and the local domain name server 102 via a network. A communication connection can be established between the local domain name server 102 and the authoritative domain name server 103 via a network. The authoritative domain name server 103 is the DNS server that ultimately resolves a domain name into an IP address.

[0044] Various client applications, such as programming applications, web browser applications, and search applications, can be installed on client 101. Client 101 can be any electronic device with a display screen and web browsing support, including but not limited to smartphones, tablet computers, and desktop computers. Local domain name server 102 and authoritative domain name server 103 can be independent servers or a server cluster consisting of multiple servers.

[0045] The domain name resolution request from client 101 is resolved by local domain name server 102. If the domain name resolution record included in the domain name resolution request does not exist in the cache of local domain name server 102 (i.e., the domain name has not been resolved within the validity period of local domain name server 102's cache), local domain name server 102 will perform a recursive query, thereby obtaining a response from authoritative domain name server 103. Authoritative domain name server 103 is the final step in the domain name resolution query and is responsible for storing domain names and IP addresses.

[0046] It is understandable that the DNS tunnel detection method provided in the embodiment of the present application can be executed by the local domain name server 102.

[0047] like Figure 2 As shown in FIG, a flow chart of a DNS tunnel detection method provided by an embodiment of the present application may specifically include the following operations.

[0048] S201. The local domain name server sends a first resolution request and a second resolution request to an authoritative domain name server.

[0049] The first resolution request includes the first domain name. The second resolution request includes the first domain name. The first resolution request and the second resolution request are used to instruct the authoritative domain name server to resolve the first domain name.

[0050] In a possible embodiment, the local domain name server can determine the number of response results of the authoritative domain name server to the first client in the query record within the first time period. The query record is used to store resolution requests from multiple client IP addresses and response results from the authoritative domain name server corresponding to the resolution requests. The resolution requests and the response results are one-to-one corresponding. The above-mentioned multiple client IP addresses include the first client IP address. When the above-mentioned number is greater than or equal to the second threshold, S201 is executed. It can be understood that the second threshold can be an empirical value pre-set by those skilled in the art, and can be reasonably set according to the specific application scenario. For example, the second threshold is a value such as 10 or 8.

[0051] For example, when a client initiates an online request, if the corresponding query record is not obtained in the client cache, the client initiates a resolution request to the local domain name server. The local domain name server receives the resolution request and caches it in the query record. The resolution request initiated by the client may include information such as the client IP address and domain name. At the same time, when the local domain name server receives a response result from the authoritative domain name server, the local domain name server also stores the response result in the query record. Figure 3 As shown, the query record includes the query time corresponding to resolution request 1 and response result 1. The query record includes the query time corresponding to resolution request 2 and response result 2.

[0052] It is understandable that the local domain name server can store all resolution requests from different clients and response results from different authoritative domain name servers.

[0053] In another possible embodiment, the local domain name server may also determine the number of response results sent by the authoritative domain name server to each client in the query record within the first time period. If the number of response results sent by the authoritative domain name server to the same client is greater than or equal to the second threshold, S201 is executed.

[0054] Compared with the prior art which only caches the response results, the above method uses the local domain name server of this application to cache the response results while also caching the resolution request corresponding to each response result. This can facilitate the subsequent determination of whether the client has initiated a resolution request to a certain authoritative domain name server based on the number of client IP addresses contained in the resolution request, thereby detecting possible DNS tunnels.

[0055] Since authoritative domain name servers are generally servers that manage second-level, third-level, and fourth-level domain names below the top-level domain name, one domain name server is usually responsible for one second-level domain name. Therefore, there is a one-to-one correspondence between authoritative domain name servers and second-level domain names. All resolution requests sent by a client to an authoritative domain name server correspond to the same second-level domain name. Therefore, the local domain name server can use the second-level domain name corresponding to the authoritative domain name server as the first domain name. For example, the first domain name can be baidu.com. The local domain name server can also use a subdomain of the above second-level domain name as the first domain name. For example, the first domain name can be www.baidu.com, tieba.baidu.com, or map.baidu.com.

[0056] In one possible embodiment, the local domain name server may determine the domain name that is most numerous among the domain names included in each resolution request from the first client IP address during the first time period. The local domain name server uses the domain name as the first domain name and sends a first resolution request including the first domain name and a second resolution request including the first domain name to the authoritative domain name server.

[0057] For example, assume the second threshold is 8. The local domain name server can determine from query records that within the first time period, the first client sent 10 resolution requests to the authoritative domain name server. Since 10 is greater than or equal to the second threshold of 8, the local domain name server can identify domain names such as www.baidu.com and tieba.baidu.com in all 10 resolution requests. The local domain name server can use www.baidu.com as the first domain name. The local domain name server can send a first resolution request containing the first domain name, as well as a second resolution request containing the first domain name, to the authoritative domain name server.

[0058] Optionally, the local domain name server may send multiple resolution requests to the authoritative domain name server. Each of the multiple resolution requests contains the same domain name. The number of multiple resolution requests may be an empirical value preset by those skilled in the art and may be appropriately set based on the specific application scenario. For example, the multiple resolution requests may be 6, 10, or the like.

[0059] S202: The local domain name server receives a first response result and a second response result from the authoritative domain name server.

[0060] The first response result includes a first domain name and a first Internet Protocol (IP) address corresponding to the first domain name, and the second response result includes a second domain name and a second IP address corresponding to the second domain name.

[0061] Optionally, the response result returned by the authoritative domain name server may also include an alias (canonical name, CNAME). CNAME allows multiple names to be mapped to the same server. For example, when a server is used to provide both www and mail services, the name of this server may be "services.example.com" and have a corresponding A record (Internet Protocol Version 4 (IPv4) address) or AAAA record (Internet Protocol Version 6 (IPv6) address). In order to facilitate users to access www and mail services separately, two aliases will be set for the server, such as "www.example.com" and "mail.example.com". When accessing "www.example.com" or "mail.example.com", the actual final request is "services.example.com" and the corresponding IP address is obtained. When the server IP address changes, there is no need to change the "www.example.com" and "mail.example.com" domain names separately. You only need to change the corresponding A record or AAAA record for "services.example.com". The other alias domain names will automatically change to the new IP address.

[0062] In a possible embodiment, when the first response result and / or the second response result include indication information indicating that the domain name resolution failed, it is determined that a DNS tunnel exists between the first client and the authoritative domain name server. The local domain name server stops sending resolution requests to the authoritative domain name server.

[0063] For example, if the first response result contains other indications such as "Domain name record does not exist (NXDOMAIN)" or "Authoritative resolution failed (SERVFAIL)", it means that the domain name resolution failed and a DNS tunnel exists between the first client and the authoritative domain name server. The local domain name server stops sending resolution requests to the authoritative domain name server.

[0064] S203: When the first response result and the second response result are different, the local domain name server sends a first test data packet to the first IP address and sends a second test data packet to the second IP address.

[0065] In a possible embodiment, the local domain name server may determine whether the first response result and the second response result are identical by comparing the first IP address included in the first response result with the second IP address included in the second response result. If the first IP address and the second IP address are identical, the first response result and the second response result are determined to be identical. If the first IP address and the second IP address are different, the first response result and the second response result are determined to be different.

[0066] Optionally, the local domain name server may also determine whether the first response result and the second response result are the same by comparing the first IP address contained in the first response result with the second IP address contained in the second response result, and whether the CNAME contained in the first response result and the CNAME contained in the second response result are the same. If the first IP address and the second IP address are the same, and the CNAME contained in the first response result and the CNAME contained in the second response result are the same, the first response result and the second response result are determined to be the same. If the first IP address and the second IP address are different, and the CNAME contained in the first response result and the CNAME contained in the second response result are different, the first response result and the second response result are determined to be different.

[0067] In the above method, by comparing whether the first IP address contained in the first response result is the same as the second IP address contained in the second response result, and / or comparing whether the CNAME is the same as the CNAME contained in the second response result, it is possible to more accurately determine whether the first response result and the second response result are the same, thereby facilitating determination of whether it is necessary to further detect the DNS tunnel by sending a test data packet.

[0068] In one possible embodiment, the local domain name server can test network connectivity using a Packet Internet Groper (Ping) IP address or domain name. Ping is a very useful tool for testing connection status and packet sending and receiving, and can verify network connectivity. In the above method, by sending a first test packet to a first IP address and a second test packet to a second IP address, it is possible to further determine whether a DNS tunnel exists between the local domain name server and the authoritative domain name server.

[0069] In the above method, when the DNS tunnel resolution verification of the first resolution request and the second resolution request is successful, but the first response result and the second response result returned by the authoritative domain name server are different, the DNS tunnel is further detected by sending a first test data packet to the first IP address and a second test data packet to the second IP address, thereby improving the accuracy of DNS tunnel detection.

[0070] Optionally, when the local domain name server sends multiple resolution requests to the authoritative domain name server, the local domain name server receives multiple response results from the authoritative domain name server. The local domain name server may compare any one of the multiple response results with the other response results in the multiple response results to determine whether the response results are the same.

[0071] In a possible embodiment, when the first IP address and the second IP address are the same, no DNS tunnel exists between the first client and the authoritative domain name server.

[0072] S204: The local domain name server receives the first time to live value of the first test data packet and the second time to live value of the second test data packet.

[0073] In one possible embodiment, after the local domain name server sends a first test data packet to the first IP address, the local domain name server may receive a first time-to-live value from the peer host. After the local domain name server sends a second test data packet to the second IP address, the local domain name server may also receive a second time-to-live value from the peer host.

[0074] Each test packet sent has a Time-to-Live field set to a high value. As the packet travels through the network, the Time-to-Live value decrements by 1 each time it passes through a router. When the Time-to-Live value reaches 0, the packet is discarded by the router. The Time-to-Live value indicates the time it takes for information to be sent and returned, representing its lifecycle.

[0075] S205: When the first lifetime value and the second lifetime value are greater than or equal to a first threshold, the local domain name server determines that a DNS tunnel exists between the local domain name server and the authoritative domain name server.

[0076] Since an attacker can disguise a remote control terminal as an authoritative domain name server and embed encrypted or encoded data in the resolution results, remote control is possible. Therefore, the time-to-live value can be used to determine the network connectivity between the local domain name server and the IP addresses included in each response result. If the time-to-live value varies significantly, it can be determined that a remote control terminal disguised as an authoritative domain name server exists, indicating that a DNS tunnel exists between the first client and the authoritative domain name server.

[0077] It is understandable that the first threshold value may be an empirical value pre-set by those skilled in the art and may be reasonably set according to specific application scenarios. For example, the first threshold value may be 10, 8, or the like.

[0078] In another possible embodiment, when the first lifetime value and the second lifetime value are less than a first threshold, it is determined that no DNS tunnel exists between the first client and the authoritative domain name server.

[0079] For example, when a client such as 107.2.11.3 issues a DNS resolution request for a unique, designed domain name such as abcdef.xyz1.com, the local domain name server first queries its cached record. If no cached record exists for the domain name, it will perform a recursive query until it receives a resolution response from a remote authoritative server. Suppose the local domain name server receives a resolution response from an attacker-controlled remote authoritative server, ns1.xyz1.com. The attacker-controlled remote authoritative server encrypts or encodes control information within the DNS resolution IP address or domain name, such as a CNAME, to disguise the information. For example, the IP address returned for an AAAA record is 2345:425:2CA1::567:5673:23b5, representing the encrypted or encoded remote control command.

[0080] Assuming that within the first time period of 3 minutes, the client 107.2.11.3 performs multiple, for example, 10 authoritative queries on the same authoritative server, such as ns1.xyz1.com, then a secondary resolution verification is performed on the domain name resolution request abcdef.xyz1.com. If the first response result of the domain name resolution request is normal, and the second response result contains indication information indicating that the domain name resolution failed, such as the status is NXDOMAIN or SERVFAIL, it is determined that a DNS tunnel exists between the client 107.2.11.3 and the authoritative server ns1.xyz123.com, and the client stops sending resolution requests to the authoritative server ns1.xyz123.com, that is, the resolution of the authoritative server ns1.xyz123.com is stopped. If the first response result and the second response result are normal, the existence of a DNS tunnel can be further determined by pinging the domain name. The local domain name server sends test data packets to the domain names contained in the first response result and the second response result, respectively, and receives the first and second lifetime values ​​returned by the peer host. Assuming the first threshold is 50, when the first lifetime value and the second lifetime value are greater than or equal to the first threshold 50, it is determined that a DNS tunnel exists between the client 107.2.11.3 and the authoritative domain name server, and the resolution request is stopped from being sent to the authoritative domain name server.

[0081] like Figure 4 As shown, the present application provides an exemplary schematic diagram of detecting a DNS tunnel. The following operations are included:

[0082] S401: Determine the number of response results of the authoritative domain name server to the first client in the query record;

[0083] S402: If the number is greater than or equal to the second threshold, send a first resolution request and a second resolution request to the authoritative domain name server;

[0084] S403: Receive a first response result and a second response result from the authoritative domain name server;

[0085] S404: Determine whether the first response result and / or the second response result includes indication information indicating that the domain name resolution failed. If so, execute S405; if not, execute S407;

[0086] S405: Determine whether a DNS tunnel exists between the first client and the authoritative domain name server;

[0087] S406: Stop sending resolution requests to the authoritative domain name server;

[0088] S407: Determine whether the first response result and the second response result are the same. If so, execute S408; if not, execute S409;

[0089] S408: Determine that no DNS tunnel exists between the first client and the authoritative domain name server;

[0090] S409: Send a first test data packet to the first IP address and send a second test data packet to the second IP address;

[0091] S410: Receive a first time-to-live value of a first test data packet and a second time-to-live value of a second test data packet;

[0092] S411: Determine whether the first survival time value and the second survival time value are greater than or equal to a first threshold value. If so, execute S412; if not, execute S413;

[0093] S412: Determine whether a DNS tunnel exists between the first client and the authoritative domain name server, and execute S406;

[0094] S413: Determine whether there is no DNS tunnel between the first client and the authoritative domain name server.

[0095] Figure 5 A schematic diagram of the structure of a DNS detection device provided in an embodiment of the present application is shown as follows: Figure 5 As shown, it includes: a transceiver module 501 and a processing module 502.

[0096] The transceiver module 501 is configured to send a first resolution request and a second resolution request to an authoritative domain name server; wherein the first resolution request includes the first domain name, and the second resolution request includes the first domain name, and the first resolution request and the second resolution request are used to instruct the authoritative domain name server to resolve the first domain name;

[0097] The transceiver module 501 is further configured to receive a first response result and a second response result from the authoritative domain name server; the first response result includes the first domain name and a first Internet Protocol IP address corresponding to the first domain name, and the second response result includes the first domain name and a second IP address corresponding to the first domain name;

[0098] The transceiver module 501 is further configured to send a first test data packet to the first IP address and a second test data packet to the second IP address when the first response result and the second response result are different;

[0099] The transceiver module 501 is further configured to receive a first time-to-live value of a first test data packet and a second time-to-live value of a second test data packet;

[0100] The processing module 502 is configured to determine that a DNS tunnel exists between the first client and the authoritative domain name server when the first lifetime value and the second lifetime value are greater than or equal to a first threshold.

[0101] Optionally, the processing module 502 is further configured to:

[0102] Determining a number of response results from the authoritative domain name server to the first client in a first time period in a query record, where the query record is used to store resolution requests from multiple client IP addresses and response results from the authoritative domain name server corresponding to the resolution requests, where the multiple client IP addresses include the first client IP address;

[0103] Sending the first resolution request and the second resolution request to the authoritative domain name server, the transceiver module 501 is specifically used to:

[0104] When the number is greater than or equal to the second threshold, the first resolution request and the second resolution request are sent to the authoritative domain name server.

[0105] The first domain name is the domain name with the largest number among the domain names included in each resolution request from the first client IP address in the first time period. The first domain name is the second-level domain name corresponding to the domain name included in each resolution request from the first client IP address in the first time period.

[0106] Optionally, the processing module 502 is further configured to:

[0107] When the first IP address and the second IP address are the same, it is determined that no DNS tunnel exists between the first client and the authoritative domain name server.

[0108] Optionally, the processing module 502 is further configured to:

[0109] When the first lifetime value and the second lifetime value are less than the first threshold, it is determined that no DNS tunnel exists between the first client and the authoritative domain name server.

[0110] Optionally, the processing module 502 is further configured to:

[0111] In a case where the first response result and / or the second response result include indication information for indicating a domain name resolution failure, it is determined that a DNS tunnel exists between the first client and the authoritative domain name server.

[0112] Optionally, after determining that a DNS tunnel exists between the first client and the authoritative domain name server, the processing module 502 is further configured to:

[0113] Stop sending resolution requests to the authoritative domain name server.

[0114] Figure 6A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0115] At least one processor 601, and a memory 602 connected to the at least one processor 601. The specific connection medium between the processor 601 and the memory 602 is not limited in the embodiment of the present application. Figure 6 In the example, the processor 601 and the memory 602 are connected via a bus 600. Figure 6 The bus 600 can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, Figure 6 The diagram is represented by only one thick line, but this does not mean that there is only one bus or one type of bus. Alternatively, the processor 601 may also be referred to as a controller, without limitation to the name.

[0116] In the embodiment of the present application, the memory 602 stores instructions that can be executed by at least one processor 601. The at least one processor 601 can execute the database maintenance method discussed above by executing the instructions stored in the memory 602. The processor 601 can implement Figure 4 The functions of each module in the device shown.

[0117] Among them, the processor 601 is the control center of the device, which can use various interfaces and lines to connect the various parts of the entire control device, and monitor the device as a whole by running or executing instructions stored in the memory 602 and calling data stored in the memory 602, the various functions of the device and processing data.

[0118] In one possible design, processor 601 may include one or more processing units. Processor 601 may integrate an application processor and a modem processor. The application processor primarily processes the operating system, driver interface, and application programs, while the modem processor primarily handles wireless communications. It is understood that the modem processor may not be integrated into processor 601. In some embodiments, processor 601 and memory 602 may be implemented on the same chip. In some embodiments, they may also be implemented on separate chips.

[0119] The processor 601 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the database maintenance method disclosed in the embodiments of the present application can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor.

[0120] The memory 602 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 602 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 602 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 602 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0121] By designing and programming the processor 601, the code corresponding to the alarm correlation analysis described in the above embodiment can be fixed into the chip, so that the chip can execute the alarm correlation analysis when it is running. Figure 2 How to design and program the processor 601 in the alarm correlation analysis method of the illustrated embodiment is a technique well known to those skilled in the art and will not be described in detail here.

[0122] It should be noted here that the above-mentioned electronic device provided in the embodiment of the present application can implement all the method steps implemented in the above-mentioned method embodiment and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as those in the method embodiment will not be described in detail here.

[0123] An embodiment of the present application further provides a computer-readable storage medium, which stores computer-executable instructions. The computer-executable instructions are used to enable a computer to execute the database maintenance method in the above embodiment.

[0124] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0125] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0126] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0127] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The steps for the function specified in one or more boxes.

[0128] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A DNS tunnel detection method, characterized in that: The method comprises: Sending a first resolution request and a second resolution request to an authoritative domain name server; wherein the first resolution request includes the first domain name, the second resolution request includes the first domain name, and the first resolution request and the second resolution request are used to instruct the authoritative domain name server to resolve the first domain name; Receiving a first response result and a second response result from the authoritative domain name server, wherein the first response result includes the first domain name and a first Internet Protocol IP address corresponding to the first domain name, and the second response result includes the first domain name and a second IP address corresponding to the first domain name; If the first response result and the second response result are different, sending a first test data packet to the first IP address and sending a second test data packet to the second IP address; receiving a first time-to-live value of the first test data packet and a second time-to-live value of the second test data packet; When the first lifetime value and the second lifetime value are greater than or equal to a first threshold, it is determined that a DNS tunnel exists between the first client and the authoritative domain name server.

2. The method according to claim 1, characterized in that The method further comprises: determining a number of response results from the authoritative domain name server to the first client in a first time period, the query record being used to store resolution requests from a plurality of client IP addresses and response results from the authoritative domain name server corresponding to the resolution requests, the plurality of client IP addresses including the first client IP address; The sending of the first resolution request and the second resolution request to the authoritative domain name server specifically includes: When the number is greater than or equal to a second threshold, the first resolution request and the second resolution request are sent to the authoritative domain name server.

3. The method according to claim 2, characterized in that The first domain name is the domain name with the largest number among the domain names included in each resolution request from the first client IP address in the first time period.

4. The method according to claim 1, wherein The method further comprises: When the first IP address and the second IP address are the same, it is determined that no DNS tunnel exists between the first client and the authoritative domain name server.

5. The method according to claim 1, wherein The method further comprises: When the first lifetime value and the second lifetime value are smaller than the first threshold, it is determined that no DNS tunnel exists between the first client and the authoritative domain name server.

6. The method according to claim 1, characterized in that The method further comprises: In a case where the first response result and / or the second response result include indication information for indicating a failure in domain name resolution, it is determined that the DNS tunnel exists between the first client and the authoritative domain name server.

7. The method according to claim 1 or 6, characterized in that After determining that a DNS tunnel exists between the first client and the authoritative domain name server, the method further includes: Stop sending resolution requests to the authoritative domain name server.

8. A DNS tunnel detection device, characterized in that: include: a transceiver module, configured to send a first resolution request and a second resolution request to an authoritative domain name server; wherein the first resolution request includes the first domain name, the second resolution request includes the first domain name, and the first resolution request and the second resolution request are used to instruct the authoritative domain name server to resolve the first domain name; The transceiver module is further configured to receive a first response result and a second response result from the authoritative domain name server; the first response result includes the first domain name and a first Internet Protocol IP address corresponding to the first domain name, and the second response result includes the first domain name and a second IP address corresponding to the first domain name; The transceiver module is further configured to, when the first response result and the second response result are different, send a first test data packet to the first IP address and send a second test data packet to the second IP address; The transceiver module is further configured to receive a first lifetime value of the first test data packet and a second lifetime value of the second test data packet; The processing module is configured to determine that a DNS tunnel exists between the first client and the authoritative domain name server when the first lifetime value and the second lifetime value are greater than or equal to a first threshold.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable by the processor, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

11. A computer program product, characterized in that When the computer program product is called by a computer, the computer is caused to execute the steps of the method according to any one of claims 1 to 7.

Images