A message processing method, device, apparatus and storage medium

Abstract

The application provides a message processing method and device, equipment and storage medium, and relates to the technical field of network security. The method comprises the following steps: extracting a to-be-detected domain name from a DNS request message; if it is determined that the to-be-detected domain name is not a set domain name, extracting a source IP address from the DNS request message; matching the to-be-detected domain name and the source IP address with a corresponding relationship between a DGA domain name and an IP address recorded in a DGA information list; if the matching is successful, processing the DNS request message according to an address state corresponding to the matched IP address in the DGA information list; if the matching is unsuccessful, performing domain name detection processing on the to-be-detected domain name by using a DGA domain name detection algorithm; and processing the DNS request message according to a domain name detection result. Thus, the security of a DGA domain name dynamically generated by a DGA algorithm is identified, and a CC attack is effectively prevented.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a message processing method, apparatus, device and storage medium. Background Technology

[0002] A botnet is a network that uses one or more propagation methods to infect a large number of hosts with bot programs (zombie programs), creating a one-to-many controllable network between the controller and the infected hosts. Attackers spread bot programs through various means to infect a large number of hosts on the Internet, and the infected hosts receive instructions from the attackers through a control channel, forming a botnet.

[0003] The botnet's master controller (the attacker) issues commands to the bot via the botnet's command and control (C&C) server, which acts as the interface between the botnet and the botnet. Some malware, including certain botnet programs, after infecting internal network hosts, needs to periodically communicate with the external C&C server to receive instructions from it and transmit private data from the infected host, thereby achieving the goal of stealing private data from the internal network.

[0004] Typically, the aforementioned malware can communicate with the C&C server in the following ways: using a fixed IP address, communicating with the C&C server through a fixed domain name, selecting a domain name from a static domain name list to communicate with the C&C server, or communicating with the C&C server through a domain name dynamically generated by the DGA algorithm (Domain Generation Algorithm).

[0005] Among the communication methods mentioned above, communication methods using fixed IP addresses, static domain names, and static domain name lists are easily blocked by IP address blacklists and domain name blacklists. However, domain names dynamically generated by the DGA algorithm are unpredictable, allowing malware to easily bypass traditional blacklist-based defenses and communicate with C&C servers, thereby achieving the goal of stealing private data from the internal network.

[0006] In existing networks, network security devices such as firewalls can enable IP reputation and DNS reputation functions to block botnet IPs or malicious DNS attacks using IP reputation databases. However, both IP reputation and DNS reputation functions rely on local signature databases for botnet and CC attack matching. While this can block some botnets and CC attacks, the signature databases cannot be updated in real time, resulting in a limited interception rate. Failure to address this issue will pose certain security risks.

[0007] Therefore, how to perform security identification on domain names dynamically generated by the DGA algorithm in order to prevent CC attacks is one of the technical issues worth considering. Summary of the Invention

[0008] In view of this, this application provides a message processing method, apparatus, device and storage medium for security identification of domain names dynamically generated by the DGA algorithm, so as to prevent CC attacks.

[0009] Specifically, this application is implemented through the following technical solution:

[0010] According to a first aspect of this application, a message processing method is provided, comprising:

[0011] Extract the domain name to be detected from the DNS request message;

[0012] If it is determined that the domain name to be detected is not a set domain name, then the source IP address is extracted from the DNS request message;

[0013] The correspondence between the domain name to be detected, the source IP address, and the DGA domain name and IP address recorded in the DGA information list is matched.

[0014] If a match is found, the DNS request message is processed according to the address status corresponding to the IP address matched in the DGA information list.

[0015] If the match fails, the DGA domain name detection algorithm is used to perform domain name detection processing on the domain name to be detected; the DNS request message is processed according to the domain name detection result.

[0016] According to a second aspect of this application, a message processing apparatus is provided, comprising:

[0017] The extraction module is used to extract the domain name to be detected from DNS request messages;

[0018] The judgment module is used to determine whether the domain name to be detected is a set domain name;

[0019] The extraction module is further configured to extract the source IP address from the DNS request message when the judgment module determines that the domain name to be detected is not a set domain name;

[0020] The matching module is used to match the correspondence between the domain name to be detected, the source IP address and the DGA domain name and IP address recorded in the DGA information list;

[0021] The processing module is configured to process the DNS request message according to the address status corresponding to the IP address matched in the DGA information list if the matching module succeeds; if the matching module fails to match, perform domain name detection processing on the domain name to be detected using the DGA domain name detection algorithm; and process the DNS request message according to the domain name detection result.

[0022] According to a third aspect of this application, an electronic device is provided, including a processor and a machine-readable storage medium storing a computer program executable by the processor, the processor being prompted by the computer program to perform the method provided in the first aspect of the embodiments of this application.

[0023] According to a fourth aspect of this application, a machine-readable storage medium is provided, which stores a computer program that, when invoked and executed by a processor, causes the processor to perform the method provided in the first aspect of the embodiments of this application.

[0024] The beneficial effects of the embodiments of this application are as follows:

[0025] The message processing method, apparatus, device, and storage medium provided in this application embodiment extracts the domain name to be detected from the DNS request message; if it is determined that the domain name to be detected is not a set domain name, the source IP address is extracted from the DNS request message; the correspondence between the domain name to be detected, the source IP address, and the DGA domain name and IP address recorded in the DGA information list is matched; if the match is successful, the DNS request message is processed according to the address status corresponding to the matched IP address in the DGA information list; if the match is unsuccessful, the domain name to be detected is detected using the DGA domain name detection algorithm; and the DNS request message is processed according to the domain name detection result. In this way, it is possible to accurately identify whether the domain name to be detected in the received message is a DGA domain name, thereby ensuring the security of the intranet and preventing the leakage of private data on the intranet. Attached Figure Description

[0026] Figure 1 This is a flowchart illustrating a message processing method provided in an embodiment of this application;

[0027] Figure 2 This is a schematic diagram of the structure of a message processing device provided in an embodiment of this application;

[0028] Figure 3 This is a schematic diagram of the hardware structure of an electronic device that implements a message processing method according to an embodiment of this application. Detailed Implementation

[0029] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application.

[0030] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used herein are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any and all possible combinations of one or more of the corresponding listed items.

[0031] It should be understood that although the terms first, second, third, etc., may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0032] Before introducing this application, let's first introduce the technical terms involved in this application:

[0033] The DGA algorithm is a pseudo-random algorithm that takes a specific random seed (usually the current system date) as input and outputs a series of domain name strings with the following characteristics:

[0034] Randomness: The text of the domain name strings generated by different random seeds varies greatly.

[0035] One-wayness: The controller of the malware can use a specific random seed to reconstruct the domain name that the malware will use when communicating with the C&C server, while others cannot reverse the DGA algorithm or random seed from the domain name string.

[0036] The message processing method provided in this application is described in detail below.

[0037] See Figure 1 , Figure 1 This is a flowchart of a message processing method provided in this application. This method can be applied to network security devices, which may be, but are not limited to, firewall devices. When implementing this method, the aforementioned network security device may include the following steps:

[0038] S101. Extract the domain name to be detected from the DNS request message.

[0039] In this step, after the network security device captures the DNS request message, in order to ensure the security of the intranet, the network security device needs to extract the domain name from the DNS request message and record it as the domain name to be detected, so as to perform security identification on the domain name to be detected.

[0040] S102. If it is determined that the domain name to be detected is not a set domain name, then the source IP address is extracted from the DNS request message.

[0041] In this step, to avoid the processing speed issues of image security domains caused by security identification of some secure domains, this application proposes to pre-build a domain whitelist of domains considered secure. This whitelist records secure domains, which are the aforementioned designated domains. Thus, when the domain to be detected is identified as being in the whitelist, that is, when the domain to be detected is a designated domain, it indicates that the domain to be detected is secure. At this point, the DNS request message can be allowed to pass through, thus ensuring domain access for legitimate domains.

[0042] When the domain name to be detected is not in the above domain name whitelist, it can be understood that the domain name to be detected is not the set domain name, indicating that the domain name to be detected may pose a security threat. Based on this, in order to ensure the security of the internal network, the network security device needs to further identify the domain name to be detected, that is, extract the source IP address from the DNS request message, and then identify and process the domain name to be detected based on the source IP address.

[0043] S103. Match the correspondence between the domain name to be detected, the source IP address and the DGA domain name and IP address recorded in the DGA information list.

[0044] In this step, to accurately identify DGA domain names, the network security device can pre-configure the currently identified DGA domain names and determine the IP addresses of the source hosts using those DGA domain names. Then, the network security device maintains the mapping between DGA domain names and the source IP addresses using those DGA domain names, using a DGA information list to maintain this mapping. Thus, once the source IP address is obtained, the domain name to be detected and the source IP address can be matched against the mapping maintained in the DGA information list to confirm whether a mapping exists between the domain name to be detected and the source IP address.

[0045] S104. If a match is successful, the DNS request message is processed according to the address status corresponding to the IP address matched in the DGA information list.

[0046] In this step, if the DGA information list includes a correspondence between the domain name to be detected and the source IP address, it indicates a successful match, meaning the domain name to be detected is a DGA domain and there has been a previous instance of accessing the intranet using that IP address and the domain name to be detected; otherwise, it indicates an unsuccessful match, and step S105 is executed. When a match is successful, to further identify and process the DNS request message, the DGA information list also carries the address status corresponding to each IP address. This address status indicates whether the IP address is currently available. Thus, the address status corresponding to the matched IP address can be obtained, and the DNS request message can be processed according to this address status. For example, if the address status indicates that the current IP address needs to be blocked, meaning there is a situation where the current IP address is using a DGA domain name with security risks, then to ensure the security of the intranet, the DNS request message can be blocked, thereby ensuring the security of the intranet. Conversely, if the address status indicates that the current IP address is available, it means that although the domain name to be detected is a DGA domain name, it may not yet pose a security threat to the intranet. Therefore, the DNS request message may be allowed to some extent.

[0047] S105. If the match fails, the domain name to be detected is processed using the DGA domain name detection algorithm; the DNS request message is processed according to the domain name detection result.

[0048] In this step, if a match fails, it doesn't necessarily mean the domain name to be detected is not a DGA domain. It could mean the domain name hasn't been identified and recorded in the DGA information list. Therefore, to more accurately identify the domain name, the DGA domain name detection algorithm is invoked. This algorithm then identifies the domain name and processes the DNS request message based on the detection result, further ensuring intranet security. If the domain name detection result indicates the domain name is not a DGA domain, the DNS request message can be allowed, ensuring normal access. However, if the domain name is identified as a DGA domain, it indicates a security risk. In this case, one approach is to block the DNS request message to ensure intranet security; another is to further identify and process the message, thus preventing the blocking of secure DNS request messages to some extent.

[0049] It is worth noting that by executing the above-mentioned blocking DNS request message, communication with the C&C server can be blocked, thereby achieving the goal of preventing the C&C server from stealing private data on the internal network.

[0050] The message processing method provided in this application extracts the domain name to be detected from the DNS request message; if it is determined that the domain name to be detected is not a designated domain name, the source IP address is extracted from the DNS request message; the domain name to be detected, the source IP address, and the correspondence between them and the DGA domain names and IP addresses recorded in the DGA information list are matched; if the match is successful, the DNS request message is processed according to the address status corresponding to the matched IP address in the DGA information list; if the match is unsuccessful, the domain name to be detected is detected using the DGA domain name detection algorithm; and the DNS request message is processed according to the domain name detection result. In this way, it is possible to accurately identify whether the domain name to be detected in the received message is a DGA domain name, thereby ensuring the security of the internal network and preventing the leakage of private data on the internal network.

[0051] Optionally, based on the above embodiments, in this embodiment, step S104 can be executed according to the following process: if the address status is frozen, then the DNS request message is blocked; if the address status is unfrozen, then the DNS request message is allowed.

[0052] Specifically, the address status mentioned above can include a frozen state and a non-frozen state. The frozen state indicates that the current IP address needs to be disabled by the network security device, that is, DNS messages using the IP address and DGA domain name need to be blocked. The non-frozen state indicates that the current IP address is available by the network security device, and DNS request messages can be allowed in this case.

[0053] Furthermore, the DGA information list may also include the remaining freeze time. The steps for blocking the DNS request message if the address status is frozen can then be performed as follows: when the address status is frozen and the remaining freeze time corresponding to the matched IP address is not cleared, the DNS request message is blocked; when the remaining freeze time corresponding to the matched IP address is cleared, the DGA domain name detection algorithm is used to perform domain name detection processing on the domain name to be detected; and the DNS request message is processed based on the domain name detection result.

[0054] In practical applications, when the address status of the IP address corresponding to each GDA domain name recorded in the DGA information list is frozen, a remaining freeze time is maintained for that record. This remaining freeze time indicates the remaining time that the address status is disabled. This remaining freeze time can be understood as the time during which DNS request packets containing the corresponding IP address and DGA domain name need to be blocked. Based on this, when the address status of the IP address corresponding to the domain name to be detected is frozen, the remaining freeze time for that IP address can be queried. Then, it is determined whether the current remaining freeze time is cleared. If it is cleared, it indicates that the IP address corresponding to the domain name to be detected has been unfrozen, but this does not mean that the domain name to be detected is a safe domain. At this point, to further ensure the security of the internal network, the DGA domain name detection algorithm can be called again to perform domain name detection processing on the domain name to be detected; then, the DNS request packets are processed based on the domain name detection results.

[0055] If the remaining freeze time is not cleared, it indicates that the IP address of the domain name to be tested has not been unfrozen, which means that the domain name to be tested is still under security threat. Therefore, the DNS request message can be blocked directly to ensure the security of the internal network.

[0056] Optionally, the aforementioned DGA information list may also include the number of domain name accesses. When executing the step of allowing the DNS request message if the address status is not frozen, the process can be as follows: when the address status is not frozen, update the number of domain name accesses corresponding to the matched IP address; when the number of domain name accesses is higher than a first set number, allow the DNS request message; when the number of domain name accesses is not higher than the first set number, use the DGA domain name detection algorithm to perform domain name detection processing on the domain name to be detected; process the DNS request message based on the domain name detection result.

[0057] Specifically, when the IP address corresponding to the domain name to be detected in the DGA information list is identified as being in a non-frozen state, it does not necessarily mean that the DGA domain name is secure. Therefore, in order to further ensure the security of the intranet, the number of times each IP address in a non-frozen state accesses the corresponding DGA domain name will be maintained in the DGA information list, and then the DNS request message will be forwarded based on the number of times the domain name is accessed.

[0058] Specifically, after obtaining the access count of the domain name corresponding to the IP address matched by the domain name to be detected, the access count is first updated by incrementing the recorded access count by 1 (in this DNS request message) to obtain the updated access count. Then, it is determined whether the access count exceeds a first set number. If it does, it indicates that accessing the intranet using the DGA domain name and IP address is secure, and therefore, the DNS request message can be allowed. If it does not exceed the first set number, it indicates that the security of the DGA domain name cannot be determined temporarily. In this case, to further ensure the security of the intranet, the DGA domain name detection algorithm can be invoked to perform domain name detection on the domain name to be detected; then, the DNS request message is processed based on the domain name detection result.

[0059] It is worth noting that the number of domain name accesses in the aforementioned DGA information list can be understood as the number of times a DNS request message requesting the resolution of a DGA domain name is received. Furthermore, the specific value of the aforementioned first set number can be configured according to actual circumstances, and this application does not impose any limitations on it.

[0060] It should be noted that in practical applications, network security devices can be equipped with intelligent detection systems, which can then implement any of the above embodiments.

[0061] Optionally, based on any of the above embodiments, the above-mentioned domain name detection processing of the domain name to be detected using the DGA domain name detection algorithm is performed by: inputting the domain name to be detected into a pre-trained DGA domain name detection model, and having the DGA domain name detection model output the domain name detection result of the domain name to be detected.

[0062] Specifically, identified DGA domain names can be used as training samples beforehand, and then these training samples can be used to train a base model, resulting in a trained DGA domain name detection model. It's worth noting that this DGA domain name detection model can be dynamically updated; for example, it can be updated dynamically when the training samples are updated. It's also worth noting that the aforementioned base model can be, but is not limited to, a deep learning model, etc.

[0063] Based on this, after the domain name to be detected is input into the DGA domain name detection model, the model can output the confidence level of whether the domain name to be detected belongs to the DGA domain name or not. If the confidence level of belonging to the DGA domain name is higher than the set confidence level threshold, it can be confirmed that the domain name to be detected belongs to the DGA domain name; otherwise, it is confirmed that the domain name to be detected does not belong to the DGA domain name.

[0064] Furthermore, in practical applications, network security devices can be equipped with an AI engine that integrates the DGA domain name detection model. This AI engine then performs domain name detection processing on the domain name to be detected. Specifically, the intelligent detection engine can send a detection notification to the AI ​​engine, sending the domain name to be detected. The AI ​​engine then uses the DGA domain name detection model to detect the domain name and feeds the detection results back to the intelligent detection system, allowing the system to further process the DNS request messages based on the detection results.

[0065] For example, if the domain name to be detected is not a DGA domain, it indicates that the domain name to be detected belongs to a secure domain. In this case, the DNS request message can be allowed to pass through, so as to ensure the normal access of the request.

[0066] Optionally, based on any of the above embodiments, when performing the step of processing the DNS request message according to the domain name detection result, it can be implemented according to the following process: when the domain name to be detected is a DGA domain name, the number of target accesses using the source IP address and the domain name to be detected is counted; if the number of target accesses reaches a second set number, the DNS request message is blocked; if the number of target accesses is less than the second set number, the DNS request message is allowed; when the domain name to be detected is not a DGA domain name, the DNS request message is allowed.

[0067] Specifically, the domain name detection result obtained from the DGA domain name detection model is as follows: when the domain name to be detected is a DGA domain name, it indicates that the DNS request message has a certain security risk. Therefore, in order to identify more accurately, this embodiment proposes to count the number of accesses using the above-mentioned source IP address and DGA domain name, and record it as the target access count (including this access). Then, it is determined whether the target access count reaches a second preset number. When it does, it indicates that the number of accesses using the IP address and DGA domain name is relatively large, which may pose a certain security threat. Therefore, at this time, the DSN request message can be blocked according to the pre-configured processing action. When the target access count is less than the second preset number, it indicates that the network security device can have a certain tolerance limit for the DNS request message, that is, even if the DNS request message is allowed, it will not affect the internal network. Based on this, the network security device can allow the DNS request message.

[0068] Based on this, this embodiment proposes that the following process may also be included: writing the correspondence between the domain name to be detected and the source IP address into the DGA information list.

[0069] Specifically, when the target access count reaches the second set number, after writing the above correspondence into the DGA information list, if the DGA information list contains address status, the address status corresponding to the correspondence can be configured to a frozen state; at the same time, if the DGA information list includes the remaining freeze time, the remaining freeze time can be started at this time, and a timed operation can be started to update the remaining freeze time in real time.

[0070] It is worth noting that the specific value of the remaining freeze time can be configured according to the actual situation, and this application does not limit it.

[0071] Furthermore, when the target number of visits has not reached the second set number, after writing the above correspondence into the DGA information list, if the DGA information list contains address status, the address status corresponding to the IP address in the correspondence can be written to the list as non-frozen; in addition, if the DGA information list contains domain name visit counts, the domain name visit count corresponding to the correspondence in the DGA information list is configured to the value of the above target number of visits.

[0072] In addition, in this embodiment, the network security device can also output DGA domain name detection logs, so that the data analysis center can generate botnet analysis messages based on the DGA domain name detection logs, enabling administrators to accurately locate botnet hosts on the internal network, thereby effectively preventing abnormal external connections of internal network servers or hosts, and preventing the leakage of internal network host data, so as to maximize network security.

[0073] By providing the above message processing method, it is possible to effectively and accurately identify whether a DGA domain name with a security threat is carried in the DNS request message. Then, when a DGA domain name with a security threat is identified, the communication traffic between the internal network zombie host and the C&C server is blocked in a timely manner by blocking the DNS request message, which prevents CC attacks, thereby preventing the leakage of internal network privacy data and ensuring the security of the internal network.

[0074] Based on the same inventive concept, this application also provides a message processing apparatus corresponding to the above-described message processing method. Specific implementation details of this message processing apparatus can be found in the above description of the message processing method, and will not be elaborated upon here.

[0075] See Figure 2 , Figure 2 This application provides a message processing apparatus according to an exemplary embodiment, which can be installed in a network security device. The apparatus may include:

[0076] Extraction module 201 is used to extract the domain name to be detected from the DNS request message;

[0077] The judgment module 202 is used to determine whether the domain name to be detected is a set domain name;

[0078] The extraction module 201 is further configured to extract the source IP address from the DNS request message when the judgment module 202 determines that the domain name to be detected is not a set domain name;

[0079] Matching module 203 is used to match the correspondence between the domain name to be detected, the source IP address and the DGA domain name and IP address recorded in the DGA information list;

[0080] The processing module 204 is configured to process the DNS request message according to the address status corresponding to the IP address matched in the DGA information list if the matching module 203 successfully matches; if the matching module 203 fails to match, perform domain name detection processing on the domain name to be detected using the DGA domain name detection algorithm; and process the DNS request message according to the domain name detection result.

[0081] Optionally, the processing module 204 is specifically configured to block the DNS request message if the address status is frozen, and allow the DNS request message if the address status is unfrozen.

[0082] Furthermore, the DGA information list in this embodiment may also include the remaining freeze time; based on this, the processing module 204 is specifically used to block the DNS request message when the address status is frozen and the remaining freeze time corresponding to the matched IP address is not cleared; when the remaining freeze time corresponding to the matched IP address is cleared, the DGA domain name detection algorithm is used to perform domain name detection processing on the domain name to be detected; and the DNS request message is processed according to the domain name detection result.

[0083] Optionally, the DGA information list in this embodiment may further include the number of domain name accesses; based on this, the processing module 204 is specifically used to update the number of domain name accesses corresponding to the matched IP address when the address status is non-frozen; when the number of domain name accesses is higher than a first set number, the DNS request message is allowed; when the number of domain name accesses is not higher than the first set number, the domain name to be detected is detected using the DGA domain name detection algorithm; and the DNS request message is processed according to the domain name detection result.

[0084] Optionally, based on any of the above embodiments, in this embodiment, the processing module 204 is specifically used to: when the domain name to be detected is a DGA domain name, count the number of target accesses using the source IP address and the domain name to be detected; if the number of target accesses reaches a second set number, block the DNS request message; if the number of target accesses is less than the second set number, allow the DNS request message; when the domain name to be detected is not a DGA domain name, allow the DNS request message.

[0085] Furthermore, the message processing apparatus provided in this embodiment may further include:

[0086] The writing module (not shown in the figure) is used to write the correspondence between the domain name to be detected and the source IP address into the DGA information list when the domain name to be detected is a DGA domain name.

[0087] Optionally, based on any of the above embodiments, in this embodiment, the processing module 204 is further configured to allow the DNS request message when the judgment module 202 determines that the domain name to be detected is a set domain name.

[0088] In this way, it is possible to effectively and accurately identify whether DGA domains carrying security threats are carried in DNS request messages. When DGA domains with security threats are identified, the communication traffic between internal network zombie hosts and C&C servers can be blocked in a timely manner by blocking DNS request messages, thereby preventing CC attacks, preventing the leakage of internal network privacy data, and ensuring internal network security.

[0089] Based on the same inventive concept, embodiments of this application provide an electronic device, which may be, but is not limited to, the aforementioned network security device. For example... Figure 3 As shown, the electronic device includes a processor 301 and a machine-readable storage medium 302. The machine-readable storage medium 302 stores a computer program executable by the processor 301. The processor 301 is prompted by the computer program to execute the message processing method provided in any embodiment of this application. Furthermore, the electronic device also includes a communication interface 303 and a communication bus 304, wherein the processor 301, the communication interface 303, and the machine-readable storage medium 302 communicate with each other via the communication bus 304.

[0090] The communication bus mentioned in the above electronic devices can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not mean that there is only one bus or one type of bus.

[0091] The communication interface is used for communication between the aforementioned electronic devices and other devices.

[0092] The machine-readable storage medium 302 described above can be a memory, which may include random access memory (RAM), DDR SRAM (Double Data Rate Synchronous Dynamic Random Access Memory), or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0093] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0094] For embodiments of electronic devices and machine-readable storage media, since the methods involved are basically similar to those described in the foregoing method embodiments, the description is relatively simple, and relevant details can be found in the descriptions of the method embodiments.

[0095] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0096] The specific implementation process of the functions and roles of each unit / module in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0097] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The units / modules described as separate components may or may not be physically separate. The components shown as units / modules may or may not be physical units / modules, that is, they may be located in one place or distributed across multiple network units / modules. Some or all of the units / modules can be selected to achieve the purpose of this application according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0098] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method of processing a packet, the method comprising: include: Extract the domain name to be detected from the DNS request message; If it is determined that the domain name to be detected is not a set domain name, then the source IP address is extracted from the DNS request message; The correspondence between the domain name to be detected, the source IP address, and the DGA domain name and IP address recorded in the DGA information list is matched. If a match is found, the DNS request message is processed according to the address status corresponding to the IP address matched in the DGA information list. If the match fails, the domain name to be detected is processed using the DGA domain name detection algorithm. Process the DNS request message according to the domain name detection results; The DNS request message is processed according to the address status corresponding to the IP address matched in the DGA information list, including: If the address status is not frozen, then the DNS request message is allowed. The DGA information list also includes the number of domain name accesses; if the address status is not frozen, the DNS request message is allowed, including: When the address status is not frozen, update the domain name access count corresponding to the matched IP address; When the number of accesses to the domain name exceeds the first set number, the DNS request message is allowed. When the number of accesses to the domain name is not higher than the first set number, the DGA domain name detection algorithm is used to perform domain name detection processing on the domain name to be detected; and the DNS request message is processed according to the domain name detection result.

2. The method of claim 1, wherein, The DNS request message is processed according to the address status corresponding to the IP address matched in the DGA information list, including: If the address status is frozen, then the DNS request message is blocked.

3. The method according to claim 2, characterized in that, The DGA information list also includes the remaining freeze time; If the address status is frozen, then the DNS request message is blocked, including: When the address status is frozen and the remaining freeze time corresponding to the matched IP address has not been cleared, the DNS request message is blocked. When the remaining freeze time corresponding to the matched IP address is cleared to zero, the DGA domain name detection algorithm is used to perform domain name detection processing on the domain name to be detected; the DNS request message is processed according to the domain name detection result.

4. The method according to claim 1 or 3, characterized in that, Processing the DNS request message based on the domain name detection results includes: When the domain name to be detected is a DGA domain name, the number of target accesses using the source IP address and the domain name to be detected is counted. If the target access count reaches the second preset number, then the DNS request message is blocked; If the target access count is less than the second preset count, then the DNS request message is allowed. If the domain name to be detected is not a DGA domain name, then the DNS request message is allowed.

5. The method according to claim 4, characterized in that, When the domain name to be detected is a DGA domain name, the method further includes: The correspondence between the domain name to be detected and the source IP address is written into the DGA information list.

6. The method according to claim 1, characterized in that, Also includes: If the domain name to be detected is a set domain name, then the DNS request message is allowed.

7. A message processing apparatus, characterized in that, include: The extraction module is used to extract the domain name to be detected from DNS request messages; The judgment module is used to determine whether the domain name to be detected is a set domain name; The extraction module is further configured to extract the source IP address from the DNS request message when the judgment module determines that the domain name to be detected is not a set domain name; The matching module is used to match the correspondence between the domain name to be detected, the source IP address and the DGA domain name and IP address recorded in the DGA information list; The processing module is used to process the DNS request message according to the address status corresponding to the IP address matched in the DGA information list if the matching module succeeds; if the matching module fails to match, the DGA domain name detection algorithm is used to perform domain name detection processing on the domain name to be detected. Process the DNS request message according to the domain name detection results; The DNS request message is processed according to the address status corresponding to the IP address matched in the DGA information list, including: If the address status is not frozen, then the DNS request message is allowed. The DGA information list also includes the number of domain name accesses; if the address status is not frozen, the DNS request message is allowed, including: When the address status is not frozen, update the domain name access count corresponding to the matched IP address; When the number of accesses to the domain name exceeds the first set number, the DNS request message is allowed. When the number of accesses to the domain name is not higher than the first set number, the DGA domain name detection algorithm is used to perform domain name detection processing on the domain name to be detected; and the DNS request message is processed according to the domain name detection result.

8. An electronic device, characterized in that, The method includes a processor and a machine-readable storage medium storing a computer program executable by the processor, which is prompted by the computer program to perform the method according to any one of claims 1-6.

9. A machine-readable storage medium, characterized in that, The machine-readable storage medium stores a computer program that, when invoked and executed by a processor, causes the processor to perform the method according to any one of claims 1-6.

Images