A method for preventing malicious exploitation of zone-based DNS security

Abstract

The application discloses a method for preventing malicious utilization of zone-based DNS security protection, which is used as a supplement to related attack protection to prevent normal protection strategies from being maliciously utilized. A server or server cluster commonly trusted by multiple DNS recursive servers irrelevant to each other is introduced as a security control center (security cloud), the recursive servers report the obtained zone list and related data to the security cloud, the security cloud analyzes the data in a specific time of a specific zone, the security cloud obtains a whitelist zone for security protection according to the analysis, and distributes the whitelist zone to each recursive server, so that the recursive servers update the local protection strategies after receiving the new whitelist, and the whitelist zone cannot be blocked; the whitelist is continuously generated to continuously improve the related security protection.

Description

Technical Field

[0001] This application belongs to the field of computer network security technology, and specifically relates to a DNS protection method. Background Technology

[0002] With the rapid development of the internet, DNS (Domain Name System) has become an indispensable part of the network. However, DNS has also become a target for attackers. Attackers can exploit the openness and complexity of the DNS protocol to launch malicious attacks such as DNS spoofing, hijacking, and cache poisoning against DNS servers, thus compromising the security of the DNS system.

[0003] Current DNS-related attack methods, such as tunneling attacks, are likely to be addressed by blocking the relevant domain names involved in the communication based on the DNS zone (hereinafter referred to as zone) used by the attacker. Specifically, zone-based protection of DNS recursive servers statistically analyzes the DNS query requests they receive and determines whether the characteristics of the requests match the relevant threats. If a zone meets certain characteristics, it is determined that the zone is owned by a malicious attacker, and the related requests are only related to malicious behavior; therefore, once a matching characteristic is found, the entire zone will be blocked.

[0004] The inventors recognized that this zone-based protection method presents new risks: the protection could be maliciously exploited. For example, attackers could use the protection detection mechanism to send the same attack traffic to a normal zone, tricking a recursive server that has deployed this type of protection strategy into intercepting a non-malicious zone / domain. Summary of the Invention

[0005] This application provides a method for preventing malicious exploitation of zone-based DNS security protection, as a supplement to related attack protection, to prevent normal protection strategies from being maliciously exploited.

[0006] Firstly, a method for preventing malicious exploitation of zone-based DNS security protection is provided, applied to a security control center communicating with multiple recursive servers; all recursive servers deploy the same zone-based DNS security protection strategy, but the multiple recursive servers are not directly related to each other; the prevention method includes:

[0007] The security control center receives the list of zones compiled by each of the multiple recursive servers.

[0008] The security control center periodically selects regions and time periods randomly, and obtains the historical feature statistical analysis results of each recursive server within that region and time period by sending requests to all recursive servers. The center then conducts a comprehensive analysis to determine whether the region is a normal region. If it is, the region is added to the whitelist and the list is sent to all recursive servers.

[0009] The security control center continuously generates and distributes whitelists to improve security protection and prevent recursive servers from blocking non-malicious zones / domains.

[0010] Optionally, the security control center is a server node or cluster related to a security policy that is commonly trusted by the multiple recursive servers.

[0011] Optionally, the recursive server is equipped with a security module that records the historical characteristic statistical analysis results of several unblocked areas with the highest access volume within a set time range, and divides them according to multiple time windows, periodically uploading the list of areas corresponding to these data and the statistical time range corresponding to each area to the security control center.

[0012] Optionally, the security control center first filters and organizes the list of zones uploaded by each of the recursive servers, removing zones that do not meet the comprehensive analysis criteria. Zones that do not meet the comprehensive analysis criteria include: zones that exist only in the list of zones provided by a few recursive servers, and zones whose historical data coverage does not meet the set conditions.

[0013] Optionally, the comprehensive analysis to determine whether the area is a normal area specifically includes:

[0014] The statistics show how many of the recursive servers providing data analyzed during this time period indicated that there were no anomalies in the area.

[0015] If more than a set number or proportion of recursive servers identify no anomalies in the area during that time period, then the area is determined to be a normal area.

[0016] Optionally, the security control center may add the region to the whitelist while removing it from the list of regions pending processing, and then continue to check other regions in the next cycle; the security control center may periodically distribute the newly generated whitelist to all recursive servers.

[0017] Secondly, a method for preventing malicious exploitation of zone-based DNS security protection is provided, applied to a first recursive server. This first recursive server, along with several other recursive servers, deploys the same zone-based DNS security protection strategy and introduces a shared, trusted security control center for establishing communication connections. However, the recursive servers are not directly connected to each other. The prevention method includes:

[0018] The first DNS recursive server performs statistical analysis on the received DNS query requests;

[0019] The first DNS recursive server records the historical characteristics and statistical analysis results of several unblocked zones with the highest access volume within a set time range, and divides them into multiple time windows. It periodically uploads the list of zones corresponding to these data and the statistical time range corresponding to each zone to the security control center.

[0020] The first DNS recursive server receives a whitelist periodically issued by the security control center; all zones listed in the whitelist are normal zones as determined by the security control center through comprehensive analysis.

[0021] The first DNS recursive server allows requests for domain names in zones listed in the whitelist; if the first DNS recursive server is currently blocking that zone, it will unblock it.

[0022] Thirdly, a server node or cluster, serving as a security control center, includes a memory and a processor, wherein the memory stores a computer program, and the processor, when executing the computer program, implements the aforementioned prevention method applied to a security control center communicating with multiple recursive servers.

[0023] Fourthly, a recursive server includes a memory and a processor, wherein the memory stores a computer program, and the processor, when executing the computer program, implements the aforementioned defense method applied to the first recursive server.

[0024] Compared with the prior art, this application has at least the following beneficial effects:

[0025] This application introduces a shared, trusted server or server cluster as a security control center (security cloud) to multiple unrelated DNS recursive servers. The recursive servers report statistically obtained zone lists and related data to the security cloud. The security cloud selects data from specific zones within specific time periods for analysis. Based on the analysis, the security cloud derives a whitelist of zones for security protection and distributes it to each recursive server. Upon receiving the new whitelist, the recursive server updates its local protection policy to ensure that whitelisted zones are not blocked. By continuously generating whitelists, the security protection is constantly improved. Because the data obtained by the security cloud comes from multiple unrelated recursive servers, it is difficult for attackers to simultaneously attack more than half of the recursive server nodes, thus eliminating the possibility of a single node being misled by malicious requests. Furthermore, the security cloud's sampling method involves randomly selecting zones and time periods, making it difficult for attackers to construct targeted attack traffic. Attached Figure Description

[0026] Figure 1This is a schematic diagram of the overall system architecture of this application;

[0027] Figure 2 This is a schematic diagram of the execution flow of the security control center in a method for preventing malicious exploitation of zone-based DNS security protection, provided as an embodiment of this application.

[0028] Figure 3 This is a schematic diagram of the execution flow of a DNS recursive server in a method for preventing malicious exploitation of zone-based DNS security protection, provided as an embodiment of this application. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0030] In the description of this application: unless otherwise stated, "a plurality of" means two or more. The terms "first," "second," etc., used in this application are intended to distinguish the objects referred to and do not have any particular meaning in terms of technical connotation (e.g., they should not be construed as an emphasis on importance or order). Expressions such as "comprising," "including," and "having" also mean "not limited to" (certain units, steps, etc.).

[0031] This application provides a method for preventing malicious exploitation of zone-based DNS security protection, which can be applied to, for example... Figure 1 The application environment shown includes multiple recursive servers and a shared security control center (security cloud). Specifically, DNS recursive server 1, DNS recursive server 2, and DNS recursive server 3 communicate with the security control center and client devices, respectively. These recursive servers all deploy the same zone-based DNS security protection policy, but they are not directly connected to each other (they have different administrators).

[0032] In one embodiment, such as Figure 2 As shown, the security control center mainly performs the following steps:

[0033] S1: The security control center receives the list of zones obtained by the multiple recursive servers;

[0034] S2: The security control center periodically selects a region and time period randomly, and obtains the historical feature statistical analysis results of the region within the time period recorded by each recursive server by sending requests to all recursive servers. The center then conducts a comprehensive analysis to determine whether the region is a normal region. If so, the region is added to the whitelist and the list is sent to all recursive servers.

[0035] S3: The security control center continuously generates and distributes whitelists to improve security protection and prevent recursive servers from intercepting non-malicious zones / domains.

[0036] Correspondingly, if a certain recursive server is denoted as the first recursive server, then as follows: Figure 3 As shown, the first recursive server mainly performs the following steps:

[0037] S1: The first DNS recursive server performs statistical analysis on the received DNS query requests;

[0038] S2: The first DNS recursive server records the historical characteristics statistical analysis results of several unblocked zones with the highest access volume within a certain time range, and divides them according to multiple time windows. It periodically uploads the list of zones corresponding to these data and the statistical time range corresponding to each zone to the security control center.

[0039] S3: The first DNS recursive server receives a whitelist periodically issued by the security control center; all zones listed in the whitelist are normal zones determined by the security control center through comprehensive analysis.

[0040] S4: The first DNS recursive server allows domain name requests under the whitelisted zones; if the first DNS recursive server is currently blocking the zone, then the block is lifted.

[0041] The following describes in detail the working principle and process of the prevention method implemented by the security control center and multiple recursive servers:

[0042] Zone-based protection by recursive DNS servers involves statistically analyzing the DNS query requests they receive and determining whether the request characteristics match relevant threats. The mechanism of zone-based protection is that if a zone meets certain characteristics, it can be determined that the zone is owned by a malicious attacker, and related requests will only be associated with malicious behavior. Therefore, once a characteristic match is detected, the recursive DNS server will block the entire zone.

[0043] Therefore, to prevent malicious exploitation, we add high-traffic zones to the whitelist. The whitelist can be automatically synchronized from the security policy-related server or cluster (hereinafter referred to as the security cloud) to the security protection modules of each recursive server based on actual needs. Whitelist data is automatically generated and distributed to all recursive servers. The security control center continuously generates and distributes whitelists to constantly improve security protection, thereby preventing recursive servers from blocking non-malicious zones / domains. The specific implementation is as follows:

[0044] A. When the security modules of each recursive server are collecting statistics on the characteristics of each zone, they will record the historical characteristics of some unblocked zones with high access volume (such as the top 1000 or 10000) within a certain time range. The data will be divided into multiple time windows, and the list of zones corresponding to these data (which also includes the statistical time range of each zone) will be uploaded to the security cloud periodically.

[0045] B. The security cloud obtains a large number of lists of zones uploaded by different recursive servers, filters and organizes them, and removes zones that do not meet the conditions, such as those that only exist in the lists provided by a small number of recursive servers (specifically, this condition can be set to less than 50% of the total number of recursive servers, the same as the threshold set in step F later, the main purpose of which is to serve the subsequent statistical work, the analysis results below this proportion are meaningless), or those whose historical data coverage does not meet the conditions (this is mainly because although the zone exists in the statistics of most recursive servers, it may only appear in a relatively limited time range, which is not enough to play a role in the subsequent statistical work, at least it needs to be ensured that the maximum random range of the historical time period used by the security cloud in step C is covered).

[0046] C. After the security cloud organizes and updates the list of regions, it periodically selects a region randomly from it and a historical time period randomly selected. It then sends a request to all recursive servers and obtains the specific historical feature statistical analysis results of that region within that time period (the purpose of not directly requesting the recursive servers to upload the full amount of data in step A is to reduce resource consumption in communication and subsequent data processing).

[0047] D. Each recursive server provides the data requested by the security cloud.

[0048] After receiving the data returned by the recursive server, E. Security Cloud calculates the percentage of all recursive servers that provided data and whose analysis results indicate no anomalies in this area during this time period (there are sufficient traffic samples within the time period, and the analysis results show that the traffic is not malicious).

[0049] F. If more than half (or a specified percentage) of the recursive servers identify no anomalies in this area during the corresponding time period, the security cloud considers this area to be a normal area.

[0050] G.Security Cloud adds identified whitelisted regions to its database as needed, removes the region from the list of regions awaiting processing, and then continues to check other regions in the next cycle.

[0051] H. The newly generated whitelist can be periodically distributed to various recursive servers by the security cloud.

[0052] I. After the recursive server obtains a new whitelist, in addition to allowing requests to domains under that zone directly, it can also be used to unblock zones that have been mistakenly blocked. Furthermore, whitelisted zones will be excluded from the zones to be checked, allowing domains that were previously ranked lower in traffic to be included in the list for analysis.

[0053] J. After the recursive server compiles a new list of regions, it uploads it periodically again.

[0054] K. Security Cloud continuously and periodically receives and analyzes data, issues analysis results, and automatically improves the whitelist, thereby enhancing the protection effectiveness of such protection modules.

[0055] Because the data obtained by the security cloud comes from multiple unrelated recursive servers, it is difficult for attackers to simultaneously attack more than half of the recursive server nodes, thus eliminating the possibility of a single node being misled by malicious requests. Furthermore, the security cloud's sampling method involves randomly selecting regions and time periods, making it difficult for attackers to construct targeted attack traffic.

[0056] In theory, the only way to reliably disrupt the generation of whitelist zones is for an attacker to continuously launch a large number of matching attack traffic against all recursive servers and all zones. However, this is too costly and almost impossible to implement. Therefore, this embodiment can effectively and automatically prevent the malicious exploitation of the corresponding attack protection strategy.

[0057] In one embodiment, a server node or cluster is also provided as a security control center, including a memory and a processor. The memory stores a computer program, characterized in that the processor executes the computer program to implement... Figure 2 The steps of the prevention method are shown.

[0058] In one embodiment, a recursive server is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor, when executing the computer program, implements... Figure 3 The steps of the prevention method are shown.

[0059] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

Claims

1. A method for preventing malicious exploitation of zone-based DNS security protection, characterized in that, A security control center is applied to communication connections with multiple recursive servers; all of these recursive servers are deployed with the same zone-based DNS security protection strategy, but they are not directly related to each other; the prevention method includes: The security control center receives the list of zones compiled by each of the multiple recursive servers. The security control center periodically selects regions and time periods randomly, and obtains the historical feature statistical analysis results of each recursive server within that region and time period by sending requests to all recursive servers. The center then conducts a comprehensive analysis to determine whether the region is a normal region. If it is, the region is added to the whitelist and the list is sent to all recursive servers. The security control center continuously generates and distributes whitelists to improve security protection and prevent recursive servers from blocking non-malicious zones / domains.

2. The method for preventing malicious exploitation of zone-based DNS security protection according to claim 1, characterized in that, The security control center is a server node or cluster that is trusted by the multiple recursive servers for a security policy.

3. The method for preventing malicious exploitation of zone-based DNS security protection according to claim 1, characterized in that, The recursive server is equipped with a security module that records the historical characteristic statistical analysis results of several unblocked areas with the highest access volume within a set time range. It divides the data into multiple time windows and periodically uploads the list of areas corresponding to these data and the statistical time range corresponding to each area to the security control center.

4. The method for preventing malicious exploitation of zone-based DNS security protection according to claim 1, characterized in that, The security control center first filters and organizes the lists of zones uploaded by all the recursive servers it receives, removing zones that do not meet the conditions for comprehensive analysis. The areas that do not meet the comprehensive analysis conditions include: areas that exist only in the area list provided by a few recursive servers, and areas whose historical data coverage does not meet the set conditions.

5. The method for preventing malicious exploitation of zone-based DNS security protection according to claim 1, characterized in that, The comprehensive analysis to determine whether the area is a normal area specifically includes: The statistics show how many of the recursive servers providing data analyzed during this time period indicated that there were no anomalies in the area. If more than a set number or proportion of recursive servers identify no anomalies in the area during that time period, then the area is determined to be a normal area.

6. The method for preventing malicious exploitation of zone-based DNS security protection according to claim 1, characterized in that, While adding the region to the whitelist, the security control center also removes the region from the list of regions pending processing, and then continues to check other regions in the next cycle; for newly generated whitelists, the security control center periodically distributes them to all recursive servers.

7. A method for preventing malicious exploitation of zone-based DNS security protection, characterized in that, The method is applied to a first recursive server, which, along with several other recursive servers, deploys the same zone-based DNS security protection strategy and introduces a shared, trusted security control center for establishing communication connections. However, the recursive servers are not directly connected to each other. The prevention method includes: The first DNS recursive server performs statistical analysis on the received DNS query requests; The first DNS recursive server records the historical characteristics and statistical analysis results of several unblocked zones with the highest access volume within a set time range, and divides them into multiple time windows. It periodically uploads the list of zones corresponding to these data and the statistical time range corresponding to each zone to the security control center. The first DNS recursive server receives a whitelist periodically issued by the security control center; all zones listed in the whitelist are normal zones as determined by the security control center through comprehensive analysis. The first DNS recursive server allows requests for domain names in zones listed in the whitelist; if the first DNS recursive server is currently blocking that zone, it will unblock it.

8. A server node or cluster, serving as a security control center, comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the prevention method according to any one of claims 1 to 6.

9. A recursive server, comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the prevention method of claim 7.

Images