DNS hijacking detection method and device

Abstract

The DNS hijacking detection method comprises the steps that a recursive DNS server receives a query request and sends the query request to an authoritative DNS server; an analysis result corresponding to the query request is stored in the authoritative DNS server, and the analysis result is used for verifying whether the DNS is hijacked or not; receiving an analysis result returned by the authoritative DNS server, and returning the analysis result to the client; the client receives an analysis result returned by the recursive DNS server, and determines whether the analysis result is equal to a preset IP address; and when the judgment result is unequal, determining that the DNS is hijacked. Through the method, whether the DNS is hijacked or not can be simply, conveniently and quickly detected through a row of command prompt commands.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a DNS hijacking detection method and device. Background Art

[0002] The Domain Name System (DNS) is a service of the Internet. As a distributed database that maps domain names and IP addresses, it enables people to access the Internet more conveniently. As an important service of the Internet, DNS undertakes the mapping function between meaningless IP strings and highly readable domain names. Its security and stability greatly affect the user's service experience. Therefore, how to detect DNS hijacking has become a technical problem that needs to be solved urgently. Summary of the invention

[0003] In order to solve the problems existing in the prior art, the embodiments of the present application provide a method, apparatus, computing device, computer storage medium and product including a computer program for DNS hijacking detection, which can simply, conveniently and quickly detect whether the DNS is hijacked through a line of command prompt (CMD) command.

[0004] In a first aspect, an embodiment of the present application provides a method for detecting DNS hijacking, including: a recursive DNS server receives a query request and sends the query request to an authoritative DNS server; the authoritative DNS server stores a resolution result corresponding to the query request, and the resolution result is used to verify whether the DNS is hijacked; the resolution result returned by the authoritative DNS server is received, and the resolution result is returned to the client; the client receives the resolution result returned by the recursive DNS server, and determines whether the resolution result is equal to a pre-set IP address; if the judgment result is not equal, it is determined that the DNS is hijacked.

[0005] In some possible implementations, the method further includes: when the judgment result is equal, determining that DNS hijacking has not occurred.

[0006] In some possible implementations, the client sends a query request to the recursive DNS server through a CMD instruction.

[0007] In some possible implementations, the CMD instruction is a ns lookup command or a dig command.

[0008] In some possible implementations, the client sends a query request to the recursive DNS server in the form of an executable file; the executable file specifies the address of the recursive DNS server and the domain name of the query request.

[0009] In a second aspect, an embodiment of the present application provides a device for detecting DNS hijacking, comprising: a recursive module, for receiving a query request and sending the query request to an authoritative module; the authoritative module stores the resolution result corresponding to the query request, and the resolution result is used to verify whether the DNS is hijacked; the recursive module is also used to receive the resolution result returned by the authoritative module and return the resolution result to the client; a comparison module is used to determine whether the resolution result is equal to a pre-set IP address after the client receives the resolution result returned by the recursive module; if the judgment result is not equal, it is determined that the DNS is hijacked.

[0010] In some possible implementations, the comparison module is further used to determine that DNS hijacking has not occurred when the judgment results are equal.

[0011] In some possible implementations, the client sends a query request to the recursive DNS server through a CMD instruction.

[0012] In some possible implementations, the CMD instruction is a ns lookup command or a dig command.

[0013] In some possible implementations, the client sends a query request to the recursive DNS server in the form of an executable file; the executable file specifies the address of the recursive DNS server and the domain name of the query request.

[0014] In a third aspect, an embodiment of the present application provides a computer-readable storage medium, comprising computer-readable instructions. When a computer reads and executes the computer-readable instructions, the computer executes the method described in any one of the first aspects.

[0015] In a fourth aspect, an embodiment of the present application provides a computing device, comprising a processor and a memory, wherein the memory stores computer program instructions, and when the computer program instructions are executed by the processor, the method described in any one of the first aspects is executed.

[0016] In a fifth aspect, an embodiment of the present application provides a product comprising a computer program. When the computer program product runs on a processor, the processor executes the method as described in any one of the first aspects. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0018] Figure 1This is a schematic diagram of an application scenario provided by an embodiment of the present application;

[0019] Figure 2 It is a schematic diagram of a DNS hijacking detection device provided in an embodiment of the present application;

[0020] Figure 3 It is a flow chart of a method for DNS hijacking detection provided in an embodiment of the present application. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0022] The term "and / or" in this article is a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The symbol " / " in this article indicates that the associated objects are in an or relationship, for example, A / B means A or B.

[0023] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0024] To facilitate the understanding of the embodiments of the present application, the following will further explain and illustrate specific embodiments in conjunction with the accompanying drawings. The embodiments do not constitute a limitation on the embodiments of the present invention.

[0025] DNS is a domain name resolution system, which is used to find the IP address corresponding to the domain name based on the domain name. Assuming that a client needs to resolve the domain name www.xxx.com, it can initiate a request to the DNS server, and then the DNS server returns the resolved IP result wxyz to the client. In the case of DNS hijacking, attackers often tamper with the user's DNS resolution results to redirect normal resource access to the interface provided by the attacker, causing great damage to the interests of users. Effective detection of DNS hijacking is an important part of ensuring user rights and maintaining service quality. Since DNS hijacking has a certain degree of concealment, users cannot perceive whether they have been hijacked, which may cause users to be attacked for a long time and unable to troubleshoot problems in time. When unable to access a website normally, users often associate it with network problems and ignore the attack on the DNS side. Even if users can request the website normally, they cannot determine whether the resolved website is correct and safe. Therefore, a DNS hijacking detection device that allows users to conveniently and quickly self-check the DNS environment is of great significance.

[0026] Currently, there is no simple solution for detecting DNS hijacking. For most Internet users who are not related professionals, getting a stable service experience is far more important than understanding its working principle. Self-checking hijacking requires certain computer expertise. For ordinary users, it takes a lot of effort to do this work, and if you entrust others, you may need to pay a certain fee.

[0027] In view of this, the embodiments of the present application provide a simple and easy-to-use DNS hijacking detection method, which can help users efficiently determine DNS hijacking.

[0028] For example, Figure 1 A schematic diagram of an application scenario of DNS hijacking detection provided by an embodiment of the present application is shown. Figure 1 As shown, the user sends a query instruction to the recursive DNS server 120 through the client 110. After receiving the query instruction from the user, the recursive DNS server 120 accesses the authoritative DNS server 130. The authoritative DNS server 130 stores the IP address corresponding to the specific domain name, and returns the IP address, mail server and other issues related to domain name resolution corresponding to the request according to the user's request. The authoritative DNS server 130 returns the IP address corresponding to the instruction according to the query instruction sent by the recursive DNS server 120. After receiving the IP address, the recursive DNS server 120 returns the IP address to the client 110. When the query instruction sent by the user is a specific domain name request, the authoritative DNS server 130 should return the specific IP address corresponding to the specific domain name request.

[0029] Based on this application scenario, the present application provides a schematic diagram of a device structure for DNS hijacking detection. Figure 2 This is a DNS hijacking detection device provided by an embodiment of the present application. Figure 2 As shown, the DNS hijacking detection device 200 may include a recursive module 201 and an authoritative module 202.

[0030] Among them, the recursive module 201 can be Figure 1 The recursive DNS server 120 shown. The recursive module 201 is used to receive a domain name request sent by a user through a client, and return a response result corresponding to the request to the client. Specifically, the recursive module 201 adopts a recursive query method, is responsible for receiving a user's query for any domain name, and returns the result to the user. Recursive query means that the local machine sends a query request to the domain name server once, and then waits for the final result. In the case where the domain name server cannot resolve, the domain name server will query other domain name servers by itself until the final resolution result is obtained. In daily applications, the most used DNS servers are usually of this type, such as 8.8.8.8 and 114.114.114.114. In an embodiment of the present application, the recursive module 201 is a recursive DNS with an address of 159.226.8.5, and the recursive exit IP of the recursive DNS is 124.16.11.17. The user can request DNS hijacking detection through this specific IP address, or use the recursion to make ordinary domain name requests. When the recursive module 201 receives the specific IP address request sent by the user through the client, it sends the request to the authoritative module 202 and receives the return result from the authoritative module 202. Then, the return result is sent to the client.

[0031] The authority module 202 can be Figure 1 The authoritative DNS server 130 shown. The authoritative module 202 is used to store the IP address corresponding to the specific domain name, and answer the user's questions about the IP address corresponding to the domain name, the mail server, and other domain name resolution related questions. Specifically, when the recursive module 201 sends the specific IP address request sent by the user to the authoritative module 202, the authoritative module 202 queries the server, finds the exit IP corresponding to the request, and returns the exit IP to the recursive module 201. When the user uses a specific IP to request a recursive DNS with an address of 159.226.8.5, the authoritative module 202 will return the recursive exit IP address 124.16.11.17 to the recursive module 201.

[0032] Based on the DNS hijacking detection device, the present application also provides a DNS hijacking detection method. It should be understood that the device is used to execute the method in the following embodiments, and the corresponding program modules in the device have similar implementation principles and technical effects as those described in the detection method. In addition to the above-mentioned introduction, the working process of the device can also refer to the corresponding process in the following method embodiments. Exemplary, Figure 3 Schematic diagram of a DNS hijacking detection method provided by an embodiment of the present application. Figure 3 As shown, the DNS hijacking detection method may include the following steps:

[0033] S31: The recursive server receives the query request from the client and sends the request to the authoritative server. The domain name of the query request is a pre-set domain name, which is used for DNS detection.

[0034] In this embodiment, the user sends a query request to the recursive server through the client, and the recursive server can be Figure 2 The recursive module 201 shown. The query request sent by the user is a request to verify whether the DNS is hijacked. When the DNS is not hijacked, the client should receive a specific exit IP. Exemplarily, the address of the recursive module can be 159.226.8.5, and the specific website specified by the query request requested by the user is too l s.cstnet.cn. When the recursive server receives the query request of the user, it can send the query request to the authoritative server.

[0035] S32: Based on the query request, the authoritative server searches the storage for a result corresponding to the query request, and returns the result to the recursive server.

[0036] In this embodiment, the authoritative server can be Figure 2 The authoritative module 202 shown. In the authoritative server, the IP address corresponding to the specific domain name is stored. After the authoritative server receives the query request sent by the recursive server, it can query in the authoritative server to find the IP corresponding to the specific website. After finding the IP, the IP is returned to the recursive server.

[0037] S33: The recursive server returns the result to the client.

[0038] In this embodiment, after receiving the IP corresponding to the specific URL, the recursive server may return the IP to the client.

[0039] S34: The client compares the result with the specific IP to determine whether they are equal. If the result is not equal, it is determined that the DNS is hijacked.

[0040] In this embodiment, the client receives the return result of the recursive server, and the return result includes the IP address corresponding to the query request. The client can compare the received IP address with the specific IP address. When the comparison result is that the received IP address is equal to the specific IP address, it is determined that the DNS is not hijacked. When the comparison result is that the received IP address is not equal to the specific IP address, it is determined that the DNS is hijacked.

[0041] The pseudo code of the DNS hijacking detection method is as follows:

[0042]

[0043]

[0044] The above is an introduction to the DNS hijacking detection method provided in the embodiment of the present application. When the specified domain name too l s.cstnet.cn is queried by using the specified recursive DNS (159.226.8.5), the resolution result of too l s.cstnet.cn will display the recursive export IP address 124.16.11.17 of the recursive DNS server 159.226.8.5. If the returned IP is not equal to the specific IP, it means that 159.226.8.5 is not actually used to complete the resolution, and it is judged that DNS hijacking has occurred at this time; if the returned IP is equal to the specific IP, it is judged that DNS hijacking has not occurred.

[0045] For users, they only need to enter a line of CMD command on the client to complete DNS hijacking detection. The CMD command can be the ns lookup command or the dig command.

[0046] The ns lookup command is a simple instruction in CMD. Its input is ns lookup + the domain name to be queried + the specified DNS server, and its output (the return value received) is the IP address corresponding to the domain name. The example is as follows:

[0047] enter nslookup tools.cstnet.cn 159.226.8.5 Type Enter Output 124.16.11.17

[0048] If the user executes the ns lookup command and the IP address obtained is different from 124.16.11.17, it indicates that DNS hijacking may have occurred.

[0049] The dig command is a simple tool for querying DNS domain name servers. It can perform DNS lookups and display the resolution results returned from the queried domain name servers. The input of the dig command is dig + the specified DNS server + the domain name to be queried, and the output is the IP address corresponding to the domain name. The following is an example

[0050] enter dig@159.226.8.5tools.cstnet.cn Output 124.16.11.17

[0051] If the user executes the dig command and the IP address obtained is different from 124.16.11.17, it indicates that DNS hijacking may have occurred.

[0052] Of course, the above instructions such as ns lookup and dig can be encapsulated into an executable file, in which the recursive DNS server is specified as 159.226.8.5 and the request domain name is specified as *.tools.cstnet.cn. Users only need to run the executable file to directly display the query results, so as to judge whether DNS hijacking has occurred.

[0053] It is understandable that the size of the sequence number of each step in the above-mentioned embodiments does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application. In addition, in some possible implementations, the steps in the above-mentioned embodiments can be selectively executed according to actual conditions, and can be partially executed or fully executed, which is not limited here. All or part of any feature of any embodiment of the present application can be freely and arbitrarily combined without contradiction. The combined technical solution is also within the scope of the present application.

[0054] Based on the methods in the above embodiments, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program runs on a processor, the processor executes the methods in the above embodiments.

[0055] Based on the methods in the above embodiments, an embodiment of the present application provides a computer program product. When the computer program product runs on a processor, the processor executes the methods in the above embodiments.

[0056] It is understandable that the processor in the embodiments of the present application may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. The general-purpose processor may be a microprocessor or any conventional processor.

[0057] The method steps in the embodiments of the present application can be implemented by hardware or by a processor executing software instructions. The software instructions can be composed of corresponding software modules, which can be stored in random access memory (RAM), flash memory, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), registers, hard disks, mobile hard disks, CD-ROMs or any other form of storage medium known in the art. An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an ASIC.

[0058] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted through the computer-readable storage medium. The computer instructions may be transmitted from a website site, a computer, a server or a data center to another website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or a data center that includes one or more available media integrated. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)), etc.

[0059] It should be understood that the various numerical numbers involved in the embodiments of the present application are only used for the convenience of description and are not used to limit the scope of the embodiments of the present application.

Claims

1. A DNS hijacking detection method, characterized in that: The method comprises: The recursive DNS server receives the query request and sends the query request to the authoritative DNS server; the authoritative DNS server stores the parsing result corresponding to the query request, and the parsing result is used to verify whether the DNS is hijacked; Receive the resolution result returned by the authoritative DNS server and return the resolution result to the client; The client receives the resolution result returned by the recursive DNS server, and determines whether the resolution result is equal to a preset IP address; if the result is not equal, it is determined that DNS hijacking occurs.

2. The method according to claim 1, characterized in that The method further includes: when the judgment results are equal, determining that DNS hijacking has not occurred.

3. The method according to claim 1, characterized in that: The client sends the query request to the recursive DNS server through a CMD instruction.

4. The method according to claim 3, characterized in that The CMD instruction is a ns lookup command or a dig command.

5. The method according to claim 1, characterized in that The client sends the query request to the recursive DNS server in the form of an executable file; the executable file specifies the address of the recursive DNS server and the domain name of the query request.

6. A DNS hijacking detection device, characterized in that: The device comprises: A recursive module, used for receiving a query request and sending the query request to an authoritative module; the authoritative module stores a parsing result corresponding to the query request, and the parsing result is used to verify whether the DNS is hijacked; The recursive module is further used to receive the parsing result returned by the authoritative module and return the parsing result to the client; The comparison module is used to determine whether the resolution result is equal to the preset IP address after the client receives the resolution result returned by the recursive module; if the result is not equal, it is determined that DNS hijacking occurs.

7. The device according to claim 6, characterized in that The comparison module is further configured to determine that no DNS hijacking has occurred when the judgment results are equal.

8. The device according to claim 6, characterized in that The client sends the query request to the recursive DNS server through a CMD instruction.

9. The device according to claim 8, characterized in that The CMD instruction is a ns lookup command or a dig command.

10. The device according to claim 6, characterized in that The client sends the query request to the recursive DNS server in the form of an executable file; the executable file specifies the address of the recursive DNS server and the domain name of the query request.

Images