Method, device, equipment and medium for detecting satellite link security based on DNS

Abstract

The present invention discloses a method, device, equipment and medium for detecting satellite link security based on DNS, and belongs to the field of satellite link security technology. The method includes: determining the satellite IP related to the target satellite link in the current acquisition cycle; the related satellite IP includes the target satellite IP of the target network node and other satellite IPs that have a communication relationship with the target satellite IP; obtaining the domain name system DNS traffic of each related satellite IP in the current acquisition cycle, and determining the statistical value of the DNS parameter corresponding to each related satellite IP based on the DNS traffic; using the statistical value of the DNS parameter to dynamically adjust the baseline value of the DNS parameter in the previous acquisition cycle, and using the dynamically adjusted baseline value as the baseline value of the current acquisition cycle, so as to perform abnormal detection on the statistical value of the DNS parameter, and determine whether the target satellite link is safe according to the detection result. The present invention can perform security detection on the satellite link, so as to timely discover and warn APT attack behaviors.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of satellite link security technology, and in particular to a method, device, equipment and medium for detecting satellite link security based on DNS. Background Art

[0002] In recent years, some APT organizations have emerged, using satellite links to hide the location of their command and control servers to evade tracking. APT organizations intercept data sent by satellites to ground terminals, parse the satellite IP of the ground terminal, and then bind the parsed satellite IP to the domain name of their command and control server, so as to use the satellite IP of legitimate users as a disguise to communicate with other infected ground terminals through satellite links. At this time, the satellite link has been hijacked, and on the infected terminal side, since the traffic received from the satellite link is from the satellite IP of legitimate users, it will not be considered suspicious.

[0003] It can be seen that there is an urgent need to provide a method for detecting the security of satellite links to timely discover and warn of APT attack behaviors. Summary of the invention

[0004] The embodiments of the present invention provide a method, apparatus, device and medium for detecting the security of a satellite link based on DNS, which can perform security detection on the satellite link and timely discover and warn APT attack behaviors.

[0005] On the one hand, a method for detecting satellite link security based on DNS is provided, which is used to perform security detection on a target satellite link between a target network node and a satellite network, and the method includes:

[0006] Determine the satellite IP related to the target satellite link in the current acquisition cycle; the related satellite IP includes the target satellite IP of the target network node and other satellite IPs that have a communication relationship with the target satellite IP; wherein the satellite IP is an IP allocated by a satellite provider to a network node for realizing satellite communication;

[0007] Obtaining the domain name system DNS traffic of each relevant satellite IP in the current collection period, and determining the statistical value of the DNS parameter corresponding to each relevant satellite IP based on the DNS traffic;

[0008] The statistical value of the DNS parameter is used to dynamically adjust the baseline value of the DNS parameter in the previous collection cycle, and the dynamically adjusted baseline value is used as the baseline value of the current collection cycle to perform anomaly detection on the statistical value of the DNS parameter, and determine whether the target satellite link is safe based on the detection result.

[0009] On the other hand, a device for detecting satellite link security based on DNS is provided, which is used to perform security detection on a target satellite link between a target network node and a satellite network, and the device includes:

[0010] A determination unit, configured to determine a satellite IP associated with the target satellite link within a current acquisition cycle; the associated satellite IPs include a target satellite IP of the target network node and other satellite IPs having a communication relationship with the target satellite IP; wherein the satellite IP is an IP allocated by a satellite provider to a network node for realizing satellite communication;

[0011] An acquisition unit, used to acquire a domain name system DNS flow rate of each relevant satellite IP in a current acquisition period, and determine a statistical value of a DNS parameter corresponding to each relevant satellite IP based on the DNS flow rate;

[0012] A detection unit is used to dynamically adjust the baseline value of the DNS parameter in the previous acquisition cycle using the statistical value of the DNS parameter, and use the dynamically adjusted baseline value as the baseline value of the current acquisition cycle to perform anomaly detection on the statistical value of the DNS parameter, and determine whether the target satellite link is safe based on the detection result.

[0013] On the other hand, a computer device is provided, which includes a memory and a processor, wherein the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory to implement the steps of the above-mentioned method for detecting satellite link security based on DNS.

[0014] On the other hand, a computer-readable storage medium is provided, wherein a computer program is stored in the storage medium, and when the computer program is executed by a processor, the steps of the method for detecting satellite link security based on DNS are implemented.

[0015] On the other hand, a computer program product is provided, comprising a computer program, wherein when the computer program is executed by a processor, the steps of the above-mentioned method for detecting satellite link security based on DNS are implemented.

[0016] The embodiment of the present invention provides a method, device, equipment and medium for detecting the security of a satellite link based on DNS. By determining the satellite IP related to the target satellite link, it is possible to know which network nodes have a communication relationship with the target network node in the current collection period. There may be suspicious ones among these satellite IPs. By obtaining the DNS traffic of each relevant satellite IP in the current collection period, and then using the DNS traffic to determine the statistical value of the DNS parameter, since the satellite network is highly dynamic, under normal circumstances, the statistical values ​​of different collection periods will be affected by this high dynamics. Therefore, a fixed baseline value cannot be used in different collection periods. In each current collection period, it is necessary to dynamically adjust the baseline value in combination with the collection data of the current collection period so that the baseline value can reflect the latest changes in the satellite network. In this way, the statistical value of the DNS parameter in the current collection period is detected for abnormality using the dynamically adjusted baseline value, so that it is possible to more accurately detect whether the target satellite link is safe, thereby timely discovering and warning APT attack behaviors. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 It is a flow chart of a method for detecting satellite link security based on DNS provided by an embodiment of the present invention;

[0019] Figure 2 It is a structural diagram of a device for detecting satellite link security based on DNS provided by an embodiment of the present invention;

[0020] Figure 3 It is a hardware architecture diagram of a computer device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0022] As mentioned above, there is currently no method for performing security testing on satellite links.

[0023] Considering that the APT attack organization uses hijacked satellite IP to hijack the satellite link, and then communicates with the infected terminal through the hijacked satellite link, and in the process of satellite communication, DNS query is required to resolve the domain name to obtain the satellite IP bound to the domain name, so as to achieve satellite communication. The query record is located in the DNS traffic, so it is possible to consider using the DNS traffic of the satellite IP to detect whether the satellite link is secure.

[0024] In addition, satellite networks are different from terrestrial networks. Satellite networks are highly dynamic. When using DNS traffic to detect whether the satellite link is secure, a fixed baseline value cannot be used. It is necessary to use the latest changes in the satellite network status to dynamically adjust the baseline value to cope with the frequently changing satellite network environment.

[0025] The specific implementation of the above concept is described below.

[0026] Please refer to Figure 1 The embodiment of the present invention provides a method for detecting satellite link security based on DNS, which is used to perform security detection on a target satellite link between a target network node and a satellite network. The method includes:

[0027] Step 100, determining the satellite IP associated with the target satellite link in the current acquisition cycle; the associated satellite IP includes the target satellite IP of the target network node and other satellite IPs that have a communication relationship with the target satellite IP; wherein the satellite IP is an IP allocated by a satellite provider to a network node for realizing satellite communication;

[0028] Step 102, obtaining the domain name system DNS traffic of each relevant satellite IP in the current collection period, and determining the statistical value of the DNS parameter corresponding to each relevant satellite IP based on the DNS traffic;

[0029] Step 104, dynamically adjust the baseline value of the DNS parameter in the previous acquisition cycle using the statistical value of the DNS parameter, and use the dynamically adjusted baseline value as the baseline value of the current acquisition cycle to perform anomaly detection on the statistical value of the DNS parameter, and determine whether the target satellite link is safe based on the detection result.

[0030] In an embodiment of the present invention, by determining the satellite IP related to the target satellite link, it is possible to know which network nodes have a communication relationship with the target network node in the current collection cycle, and there may be suspicious satellite IPs. By obtaining the DNS traffic of each related satellite IP in the current collection cycle, and then using the DNS traffic to determine the statistical value of the DNS parameter, since the satellite network is highly dynamic, under normal circumstances, the statistical values ​​of different collection cycles will be affected by this high dynamics. Therefore, a fixed baseline value cannot be used in different collection cycles. In each current collection cycle, it is necessary to dynamically adjust the baseline value in combination with the collection data of the current collection cycle so that the baseline value can reflect the latest changes in the satellite network. In this way, the statistical value of the DNS parameter in the current collection cycle is detected for abnormality using the dynamically adjusted baseline value, so that it is possible to more accurately detect whether the target satellite link is safe, thereby timely discovering and warning APT attack behaviors.

[0031] Described below Figure 1 How the various steps are performed.

[0032] First, with respect to step 100, the satellite IP associated with the target satellite link in the current acquisition cycle is determined.

[0033] The satellite network is composed of multiple satellite nodes, and there are satellite links between adjacent satellite nodes. Satellite providers allocate satellite IPs for satellite communications to ground network nodes, so that ground network nodes use their own satellite IPs to communicate with other ground network nodes through the satellite network. When the satellite IP of a network node is hijacked, the satellite link between the network node and the satellite network is hijacked. APT attack organizations use the hijacked satellite links to communicate with infected ground network nodes via satellite to attack the infected network nodes.

[0034] When the hijacked satellite IP is used to communicate with the infected ground network node, there will be communication records in the DNS traffic. Therefore, in an embodiment of the present invention, the DNS traffic in the current collection period can be used to determine the satellite IP related to the target satellite link.

[0035] Specifically, based on the target satellite IP of the target network node, other satellite IPs that have a communication relationship with the target satellite IP in the DNS traffic within the current collection cycle are determined, so that the target satellite IP and the other satellite IPs that have a communication relationship with the target satellite IP are determined as satellite IPs related to the target satellite link.

[0036] It should be noted that the collection period can be set according to the required detection accuracy, for example, the collection period is one hour, or the collection period is one day.

[0037] Then, for step 102, the domain name system DNS traffic of each relevant satellite IP in the current collection period is obtained, and the statistical value of the DNS parameter corresponding to each relevant satellite IP is determined based on the DNS traffic.

[0038] Each satellite IP needs to perform a DNS traffic query during satellite communication, so the DNS traffic can be used to detect whether the satellite IP is suspicious. The DNS traffic can be obtained from the DNS server, and the DNS traffic records the following features:

[0039] Time dimension features, including the following DNS parameters: query timestamp, query frequency, query interval, peak and low peak query times;

[0040] Location dimension features, including the following DNS parameters: geographic location of the satellite IP, ASN (Autonomous System Number), and country / region code;

[0041] Traffic dimension characteristics, including the following DNS parameters: request type, response size, request size, query rate, and protocol type;

[0042] Domain name dimension features, including the following DNS parameters: the queried domain name (the specific domain name or subdomain name being queried), the character length of the domain name, the character composition of the domain name (the character pattern of the domain name), and the complete domain name features of the queried;

[0043] Response dimension features, including the following DNS parameters: Time to Live (TTL), response code, and whether extended DNS is supported;

[0044] Behavioral dimension features, including the following DNS parameters: query mode (frequency, regularity, burstiness, repetitiveness and other behavioral characteristics of queries), client behavior (query behavior of specific clients or users), cache status (whether from cache);

[0045] Security dimension features, including the following DNS parameters: DNS security extension status;

[0046] The network layer dimension features include the following DNS parameters: traffic of source satellite IP and destination satellite IP, source port and destination port, and TCP flags.

[0047] In the embodiment of the present invention, the DNS parameters under each of the above-mentioned dimensional features can be used as the DNS parameters required for statistics. By counting and detecting each DNS parameter, the detection coverage can be wider, so that suspicious features will not be missed. In order to reduce the resources occupied by each detection, a DNS parameter that can better express suspicious features can be selected. In the embodiment of the present invention, the DNS parameter includes at least one of the domain name, query frequency, survival time and geographical location.

[0048] In the DNS traffic of each relevant satellite IP in the current collection period, the statistical values ​​of the DNS parameters corresponding to each relevant satellite IP can be obtained.

[0049] It should be noted that the statistical value of the DNS parameter can be an actual value or specific statistical information. For example, the query frequency can be 10 times, which is an actual value, while the geographic location and domain name are actual statistical results. It can be understood that statistical values ​​that are not actual values ​​can be converted into values ​​through quantitative methods.

[0050] Finally, for step 104, the baseline value of the DNS parameter in the previous acquisition cycle is dynamically adjusted using the statistical value of the DNS parameter, and the dynamically adjusted baseline value is used as the baseline value of the current acquisition cycle to perform anomaly detection on the statistical value of the DNS parameter, and determine whether the target satellite link is safe based on the detection result.

[0051] Since the collection cycle remains unchanged, whether the statistical values ​​of the DNS parameters collected within a collection cycle are abnormal can be determined by the baseline value.

[0052] However, satellite networks are different from terrestrial networks. Satellite networks are highly dynamic. The network status, traffic patterns, query frequency, survival time, etc. in satellite links may change frequently. Such frequent changes may be caused by satellite orbit adjustments, changes in user terminal locations, switching of different services, etc. Therefore, in the embodiments of the present invention, it is not possible to use fixed baseline values ​​to perform abnormal detection on the statistical values ​​of DNS parameters in the satellite network. It is necessary to use the latest changes in the satellite network status to dynamically adjust the baseline values ​​to cope with the frequently changing satellite network environment. It can be seen that the baseline values ​​in the embodiments of the present invention are dynamically changing.

[0053] The baseline value is smoothed so that the smoothed baseline value can give greater weight to the latest data to smooth the time series data, reduce the impact of short-term fluctuations, and reflect the changing trend of the data in a timely manner.

[0054] It can be understood that each DNS parameter corresponds to a baseline value. Therefore, when the DNS parameters are determined, the baseline values ​​of each DNS parameter to be detected need to be adjusted separately, and the adjustment principles are the same.

[0055] In one embodiment of the present invention, the baseline value can be dynamically adjusted in the following manner, that is, the baseline value of the DNS parameter in the previous collection cycle is dynamically adjusted using the statistical value of the DNS parameter, including: based on the statistical value of the DNS parameter in the current collection cycle, the baseline value of the DNS parameter in the previous collection cycle is smoothed using the exponential weighted average method to obtain the baseline value of the DNS parameter in the current collection cycle.

[0056] Exponentially weighted average method (EWMA) is a smoothing technique that processes data by weighted average, making the latest data have a greater impact on the current state, while the impact of historical data gradually decreases. The exponentially weighted average method is used to combine historical baseline values ​​with the statistical values ​​of the currently collected DNS parameters to smooth the baseline value, thereby eliminating the noise caused by short-term data fluctuations and capturing more stable long-term trends. In addition, by dynamically adjusting the baseline value, normal fluctuations and abnormal behaviors can still be accurately distinguished in a highly dynamic environment.

[0057] Specifically, during the smoothing process, the baseline value of the DNS parameter in the current collection period can be calculated using the following formula:

[0058]

[0059] Among them, EWMA t is the baseline value of the DNS parameter in the current collection period, is the baseline value of the DNS parameter in the previous collection cycle, α is the smoothing coefficient, and the smoothing coefficient is a positive number less than 1, x t It is the statistical value of DNS parameters in the current collection period.

[0060] The smoothing coefficient is used to characterize the sensitivity of the baseline value to the latest data changes. The larger the smoothing coefficient, the more sensitive the baseline value is to the latest data changes. Conversely, the smaller the smoothing coefficient, the less sensitive the baseline value is to the latest data changes.

[0061] In the embodiment of the present invention, the smoothing coefficient may be a fixed value.

[0062] Furthermore, considering that the satellite network has high latency in addition to high dynamics, that is, the satellite link has a high round-trip signal delay, which may affect the real-time performance of data updates, thereby increasing the difficulty of anomaly detection. In the embodiment of the present invention, the data fluctuation problem caused by high latency can be dealt with by adjusting the smoothing coefficient.

[0063] Specifically, before using the exponentially weighted average method to smooth the baseline value of the DNS parameter in the previous collection cycle, it can also include: determining the network delay of the target satellite link in the current collection cycle; determining the smoothing coefficient in the current collection cycle according to the network delay in the current collection cycle; wherein, the greater the network delay in the current collection cycle, the smaller the smoothing coefficient; the smaller the network delay in the current collection cycle, the larger the smoothing coefficient.

[0064] When the network delay is high, by reducing the smoothing coefficient, historical data can have a greater weight in the baseline value calculation process, thereby balancing the data deviation caused by the delay; when the network delay is small, the smoothing coefficient can be increased to make the baseline value more sensitive to new data, thereby promptly reflecting changes in network status.

[0065] In one implementation method of adjusting the smoothing coefficient, the network delay can be divided into at least two ranges by setting a delay threshold, and different ranges correspond to a smoothing coefficient; in another implementation method, the smoothing coefficient can be determined by setting a linear ratio and using the product of the linear ratio and the network delay. It can be understood that the linear ratio is an inverse proportional relationship.

[0066] After obtaining the baseline value of the DNS parameter in the current collection period, the baseline value of the current collection period can be used to perform anomaly detection on the statistical value of the DNS parameter. In the embodiment of the present invention, the anomaly detection can be implemented in at least the following ways:

[0067] Method 1:

[0068] In the first method, the baseline value can be used to determine the normal range, and determine whether the statistical value of the DNS parameter is within the normal range. If so, the DNS parameter is determined to be normal, otherwise, the DNS parameter is determined to be abnormal.

[0069] In the embodiment of the present invention, the normal range can be determined by using the standard deviation σ of the baseline value in several acquisition cycles. The standard deviation is a statistical indicator to measure the degree of dispersion of a data set, which is used to indicate the average deviation between the data point and the mean. The normal threshold can be set to EWMA t ±kσ, where k is a constant, for example, k can be 2 or 3. The value of k determines the tolerance to fluctuations.

[0070] Method 2:

[0071] In the second method, the baseline values ​​of the DNS parameters within several collection cycles can be used to calculate the baseline standard deviation and the baseline average value; the Z value can be calculated using the baseline standard deviation, the baseline average value and the statistical value of the DNS parameters in the current collection cycle; and it is determined whether the Z value exceeds a preset threshold. If so, the DNS parameters are abnormal; otherwise, the DNS parameters are normal.

[0072] The Z value is a standard score, which is a quantity that describes the relative position of the original data in the population with the mean as the reference point and the standard deviation as the unit. By calculating the Z value, the general normal distribution can be converted to the standard normal distribution.

[0073] The Z value can be calculated as: μ is the baseline mean, and σ is the baseline standard deviation.

[0074] The setting of the preset threshold is similar to the setting of the constant k value in method 1, for example, the preset threshold is 2. If the Z value exceeds 2, it indicates that the DNS parameters are abnormal, otherwise, the DNS parameters are normal.

[0075] Since anomaly detection is performed on the statistical value of each DNS parameter corresponding to each relevant satellite IP, if there is an anomaly in any DNS parameter corresponding to any relevant satellite IP, it can be determined that the target satellite link is unsafe, indicating that the target satellite link may be hijacked and an early warning is required.

[0076] According to an embodiment of the present invention, by determining the satellite IP related to the target satellite link, it is possible to know which network nodes have a communication relationship with the target network node in the current collection cycle, and there may be suspicious satellite IPs. By obtaining the DNS traffic of each related satellite IP in the current collection cycle, and then using the DNS traffic to determine the statistical value of the DNS parameter, since the satellite network is highly dynamic, under normal circumstances, the statistical values ​​of different collection cycles will be affected by this high dynamics. Therefore, a fixed baseline value cannot be used in different collection cycles. In each current collection cycle, the baseline value needs to be updated in combination with the collection data of the current collection cycle so that the baseline value can reflect the latest changes in the satellite network. In this way, the statistical value of the DNS parameter in the current collection cycle is detected for abnormality using the updated baseline value, so that it is possible to more accurately detect whether the target satellite link is safe, thereby timely discovering and warning APT attack behaviors.

[0077] Please refer to Figure 2 The embodiment of the present invention provides a device for detecting satellite link security based on DNS, which is used to perform security detection on a target satellite link between a target network node and a satellite network, and the device includes:

[0078] The determination unit 200 is used to determine the satellite IP related to the target satellite link in the current acquisition cycle; the related satellite IP includes the target satellite IP of the target network node and other satellite IPs that have a communication relationship with the target satellite IP; wherein the satellite IP is an IP allocated by a satellite provider to a network node for realizing satellite communication;

[0079] The acquisition unit 202 is used to acquire the domain name system DNS traffic of each relevant satellite IP in the current collection period, and determine the statistical value of the DNS parameter corresponding to each relevant satellite IP based on the DNS traffic;

[0080] The detection unit 204 is used to dynamically adjust the baseline value of the DNS parameter in the previous acquisition cycle using the statistical value of the DNS parameter, and use the dynamically adjusted baseline value as the baseline value of the current acquisition cycle to perform anomaly detection on the statistical value of the DNS parameter, and determine whether the target satellite link is safe based on the detection result.

[0081] In one embodiment of the present invention, the DNS parameter includes at least one of a domain name, a query frequency, a survival time and a geographical location.

[0082] In one embodiment of the present invention, when the detection unit uses the statistical value of the DNS parameter to determine the baseline value of the DNS parameter in the current collection cycle, it specifically includes: based on the statistical value of the DNS parameter in the current collection cycle, using the exponential weighted average method to smooth the baseline value of the DNS parameter in the previous collection cycle to obtain the baseline value of the DNS parameter in the current collection cycle.

[0083] In one embodiment of the present invention, when the detection unit uses the exponential weighted average method to smooth the baseline value of the DNS parameter in the previous collection cycle, it specifically includes:

[0084] The baseline value of the DNS parameter in the current collection period is calculated using the following formula:

[0085]

[0086] Among them, EWMA t is the baseline value of the DNS parameter in the current collection period, is the baseline value of the DNS parameter in the previous collection cycle, α is the smoothing coefficient, and the smoothing coefficient is a positive number less than 1, x t It is the statistical value of DNS parameters in the current collection period.

[0087] In one embodiment of the present invention, the detection unit is further used to determine the network delay of the target satellite link in the current acquisition cycle before smoothing the baseline value of the DNS parameter in the previous acquisition cycle using the exponential weighted average method; determine the smoothing coefficient in the current acquisition cycle based on the network delay in the current acquisition cycle; wherein, the greater the network delay in the current acquisition cycle, the smaller the smoothing coefficient; and the smaller the network delay in the current acquisition cycle, the larger the smoothing coefficient.

[0088] In one embodiment of the present invention, when the detection unit uses the baseline value of the current collection cycle to perform anomaly detection on the statistical value of the DNS parameter, it specifically includes: using the baseline values ​​of the DNS parameters in several collection cycles to calculate the baseline standard deviation and the baseline average; using the baseline standard deviation, the baseline average and the statistical value of the DNS parameter in the current collection cycle to calculate the Z value; determining whether the Z value exceeds a preset threshold, if so, the DNS parameter is abnormal, otherwise, the DNS parameter is normal.

[0089] It should be noted that: the device for detecting satellite link security based on DNS provided in the above embodiment is only illustrated by the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the device for detecting satellite link security based on DNS provided in the above embodiment and the method embodiment for detecting satellite link security based on DNS belong to the same concept. The specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0090] The embodiment of the present application also provides a computer device, please refer to Figure 3 The computer device includes a processor and a memory, wherein at least one instruction, at least one program, a code set or an instruction set is stored in the memory, and the at least one instruction, at least one program, a code set or an instruction set is loaded and executed by the processor to implement the method for detecting satellite link security based on DNS provided in the above-mentioned method embodiments.

[0091] An embodiment of the present application also provides a computer-readable storage medium, on which is stored at least one instruction, at least one program, code set or instruction set, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by a processor to implement the method for detecting satellite link security based on DNS provided in the above-mentioned method embodiments.

[0092] An embodiment of the present application also provides a computer program product, which includes a computer program. A processor of a computer device reads the computer program from a computer-readable storage medium, and the processor executes the computer program, so that the computer device executes the method for detecting satellite link security based on DNS as described in any of the above embodiments.

[0093] For the convenience of description, the above system or device is described by dividing it into various modules or units according to its functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0094] It can be known from the description of the above implementation methods that those skilled in the art can clearly understand that the present application can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present application can be essentially or partly contributed to the prior art in the form of a software product, which can be stored in a storage medium such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in the various embodiments of the present application or certain parts of the embodiments.

[0095] Finally, it should be noted that, in this article, relational terms such as first, second, third and fourth are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0096] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for detecting satellite link security based on DNS, characterized in that: For performing security detection on a target satellite link between a target network node and a satellite network, the method comprises: Determine the satellite IP related to the target satellite link in the current acquisition cycle; the related satellite IP includes the target satellite IP of the target network node and other satellite IPs that have a communication relationship with the target satellite IP; wherein the satellite IP is an IP allocated by a satellite provider to a network node for realizing satellite communication; Obtaining the domain name system DNS traffic of each relevant satellite IP in the current collection period, and determining the statistical value of the DNS parameter corresponding to each relevant satellite IP based on the DNS traffic; Dynamically adjust the baseline value of the DNS parameter in the previous acquisition cycle by using the statistical value of the DNS parameter, and use the dynamically adjusted baseline value as the baseline value of the current acquisition cycle to perform abnormal detection on the statistical value of the DNS parameter, and determine whether the target satellite link is safe according to the detection result; The dynamically adjusting the baseline value of the DNS parameter in the previous collection cycle by using the statistical value of the DNS parameter includes: based on the statistical value of the DNS parameter in the current collection cycle, using the exponential weighted average method to smooth the baseline value of the DNS parameter in the previous collection cycle to obtain the baseline value of the DNS parameter in the current collection cycle; The exponentially weighted average method is used to smooth the baseline value of the DNS parameter in the previous collection cycle, including: using the following formula to calculate the baseline value of the DNS parameter in the current collection cycle: Among them, EWMA t is the baseline value of the DNS parameter in the current collection period, EWMA t−1 is the baseline value of the DNS parameter in the previous collection cycle, is the smoothing coefficient, which is a positive number less than 1. t It is the statistical value of DNS parameters in the current collection period.

2. The method according to claim 1, characterized in that The DNS parameters include at least one of a domain name, a query frequency, a survival time, and a geographic location.

3. The method according to claim 1, characterized in that Before the exponentially weighted average method is used to smooth the baseline value of the DNS parameter in the previous collection cycle, the method further includes: Determining a network delay of the target satellite link within a current acquisition cycle; The smoothing coefficient in the current collection cycle is determined according to the network delay in the current collection cycle; wherein, the greater the network delay in the current collection cycle, the smaller the smoothing coefficient; the smaller the network delay in the current collection cycle, the larger the smoothing coefficient.

4. The method according to any one of claims 1 to 3, characterized in that: The method of performing abnormality detection on the statistical value of the DNS parameter by using the baseline value of the current collection period includes: Using the baseline values ​​of DNS parameters within several acquisition cycles, the baseline standard deviation and baseline mean are calculated; Calculate the Z value using the baseline standard deviation, the baseline average value and the statistical value of the DNS parameter in the current acquisition period; Determine whether the Z value exceeds a preset threshold value. If so, the DNS parameter is abnormal; otherwise, the DNS parameter is normal.

5. A device for detecting satellite link security based on DNS, characterized in that: The device is used to perform security detection on a target satellite link between a target network node and a satellite network, the device comprising: A determination unit, configured to determine a satellite IP associated with the target satellite link within a current acquisition cycle; the associated satellite IPs include a target satellite IP of the target network node and other satellite IPs having a communication relationship with the target satellite IP; wherein the satellite IP is an IP allocated by a satellite provider to a network node for realizing satellite communication; An acquisition unit, used to acquire a domain name system DNS flow rate of each relevant satellite IP in a current acquisition period, and determine a statistical value of a DNS parameter corresponding to each relevant satellite IP based on the DNS flow rate; a detection unit, configured to dynamically adjust a baseline value of the DNS parameter in a previous acquisition cycle using the statistical value of the DNS parameter, and use the dynamically adjusted baseline value as the baseline value of the current acquisition cycle, so as to perform anomaly detection on the statistical value of the DNS parameter, and determine whether the target satellite link is secure according to the detection result; When the detection unit uses the statistical value of the DNS parameter to determine the baseline value of the DNS parameter in the current collection cycle, the detection unit specifically includes: based on the statistical value of the DNS parameter in the current collection cycle, using the exponential weighted average method to smooth the baseline value of the DNS parameter in the previous collection cycle to obtain the baseline value of the DNS parameter in the current collection cycle; When the detection unit uses the exponential weighted average method to smooth the baseline value of the DNS parameter in the previous collection cycle, it specifically includes: using the following formula to calculate the baseline value of the DNS parameter in the current collection cycle: Among them, EWMA t is the baseline value of the DNS parameter in the current collection period, EWMA t−1 is the baseline value of the DNS parameter in the previous collection cycle, is the smoothing coefficient, which is a positive number less than 1. t It is the statistical value of DNS parameters in the current collection period.

6. The device according to claim 5, characterized in that The DNS parameters include at least one of a domain name, a query frequency, a survival time, and a geographic location.

7. The device according to claim 5, characterized in that The detection unit is further used to determine the network delay of the target satellite link in the current collection cycle before smoothing the baseline value of the DNS parameter in the previous collection cycle using the exponential weighted average method; determine the smoothing coefficient in the current collection cycle according to the network delay in the current collection cycle; wherein, the greater the network delay in the current collection cycle, the smaller the smoothing coefficient; and the smaller the network delay in the current collection cycle, the larger the smoothing coefficient.

8. The device according to any one of claims 5 to 7, characterized in that: When the detection unit uses the baseline value of the current collection cycle to perform anomaly detection on the statistical value of the DNS parameter, it specifically includes: using the baseline values ​​of the DNS parameters in several collection cycles to calculate the baseline standard deviation and the baseline average; using the baseline standard deviation, the baseline average and the statistical value of the DNS parameter in the current collection cycle to calculate the Z value; determining whether the Z value exceeds a preset threshold, if so, the DNS parameter is abnormal, otherwise, the DNS parameter is normal.

9. A computer device, characterized in that: The computer device includes a memory and a processor, the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory to implement the steps of any one of the methods described in claims 1-4.

10. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method described in any one of claims 1 to 4 are implemented.

11. A computer program product, characterized in that The method comprises a computer program, wherein when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.

Images