Domain name system request monitoring method, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a domain name system request monitoring method, electronic equipment and a storage medium, and aims to realize efficient monitoring of DNS requests. The method comprises the steps that the first program collects network connection information associated with a domain name system (DNS) request by intercepting information obtained in the calling process of a first kernel function, and the first kernel function comprises a kernel function needing to be called when the client side initiates the DNS request; and the second program analyzes the network connection information associated with the DNS request to obtain a detection result of whether the DNS request has a threat.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a domain name system request monitoring method, an electronic device, and a storage medium. Background Art

[0002] The Domain Name System (DNS) is a service of the Internet. As a distributed database that maps domain names and Internet Protocol (IP) addresses to each other, it enables users to access the Internet more conveniently.

[0003] When users access the DNS server through the client, they usually monitor the DNS requests initiated by the client to detect threats from malware. However, traditional DNS request monitoring methods are mainly implemented through the collection and analysis of DNS logs. With the massive increase in DNS requests, it is difficult to monitor DNS requests efficiently. Summary of the invention

[0004] In view of the above problems, the embodiments of the present application provide a domain name system request monitoring method, an electronic device, and a storage medium to overcome the above problems or at least partially solve the above problems.

[0005] In a first aspect of an embodiment of the present application, a method for monitoring a domain name system request is provided, which is executed by a target program configured on a client, wherein the target program includes a first program running in a kernel state and a second program running in a user state, and the method includes:

[0006] The first program collects network connection information associated with a domain name system DNS request by intercepting information obtained during the calling process of the first kernel function, wherein the first kernel function includes: a kernel function required to be called when the client initiates a DNS request;

[0007] The second program obtains a detection result of whether the DNS request poses a threat by analyzing the network connection information associated with the DNS request.

[0008] A second aspect of an embodiment of the present application provides an electronic device, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; the memory is used to store computer programs; the processor is used to implement the domain name system request monitoring method as described in the first aspect of the embodiment of the present application when executing the program stored in the memory.

[0009] A third aspect of the embodiments of the present application provides a computer-readable storage medium having a computer program / instruction stored thereon. When the computer program / instruction is executed by a processor, the method for monitoring domain name system requests as described in the first aspect of the embodiments of the present application is implemented.

[0010] The embodiments of the present application include the following advantages: by configuring the first program to intercept information of the first kernel function related to initiating the DNS request, the kernel-level collection function of the network connection information required for DNS request threat detection can be implemented, so that the information collection location is closer to the information generation location, thereby improving the information collection efficiency in the DNS request monitoring process, and then by configuring the second program to timely analyze the information collected by the first program to implement the threat detection function for the DNS request, thereby achieving efficient monitoring of the DNS request with the help of the collaboration between programs running at different working levels (i.e., kernel state and user state). BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments of the present application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0012] Figure 1 It is a flowchart of the steps of a method for monitoring domain name system requests in an embodiment of the present application;

[0013] Figure 2 is a flowchart of another method for monitoring domain name system requests in an embodiment of the present application;

[0014] Figure 3 is a flowchart of another method for monitoring domain name system requests in an embodiment of the present application;

[0015] Figure 4 It is a structural diagram of a domain name system request monitoring device according to an embodiment of the present application;

[0016] Figure 5 It is a schematic diagram of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0017] First of all, in order to facilitate understanding of the technical solutions provided by the present application, the main technical concepts involved in the embodiments of the present application are briefly described below.

[0018] Program: consists of functions (as well as variables and data structures, etc.) with certain functions.

[0019] Kernel state: also known as kernel space, is mainly used to run operating system programs. Programs running in kernel state (hereinafter referred to as kernel state programs) have unlimited access capabilities, such as being able to access all data in memory and use all hardware resources of the computer.

[0020] User state; also known as user space, is mainly used to run user programs (i.e., applications compiled by users themselves); programs running in user state (hereinafter referred to as user state programs) have limited access capabilities, for example, they can only access memory data in a limited manner, and are not allowed to access peripheral devices such as hard disks and network cards.

[0021] Kernel function: a function with preset functions provided by the kernel; the interface of the kernel function is also called a system call. A program running in user mode can pass relevant requests to the kernel through the interface of the relevant kernel function (i.e. the relevant system call), thereby calling the kernel function to perform relevant processing in the kernel state and returning the processing result to the program.

[0022] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0023] Reference Figure 1 As shown, a flowchart of a method for monitoring a domain name system request in an embodiment of the present application is shown. The method for monitoring a domain name system request is executed by a target program configured on a client. The target program includes a first program running in a kernel state and a second program running in a user state. The method includes the following steps:

[0024] Step S11: The first program collects network connection information associated with a domain name system DNS request by intercepting information obtained during the calling process of the first kernel function, wherein the first kernel function includes: a kernel function required to be called when the client initiates a DNS request.

[0025] In specific implementation, according to actual needs, business servers and other devices that need to access the DNS server can be used as clients, and the above-mentioned target program can be configured for the client. When the client then calls the first kernel function, that is, when the interface call parameters are passed to the interface of the first kernel function to initiate a DNS request to query the DNS server for the domain name resolution result, the first program in the target program will intercept the information obtained by the first kernel function during this call accordingly. For example, the first program can intercept the interface call parameters obtained by the first kernel function, and / or, after the first kernel function performs relevant processing based on the interface call parameters, the first program can intercept the interface return parameters determined by the first kernel function. Then, from the intercepted interface call parameters (and / or, the interface return parameters), the network connection information such as the port number (such as the port number of the source port and the target port), the protocol type, and the queried domain name associated with the DNS request initiated by the client this time are collected.

[0026] Step S12: The second program obtains a detection result of whether the DNS request contains a threat by analyzing the network connection information associated with the DNS request.

[0027] In specific implementation, the second program in the target program can receive the network connection information sent by the first program, or obtain the network connection information collected by the first program through the data sharing function between the kernel state and the user state (such as a shared memory area). After obtaining the network connection information, the second program can perform threat detection on the corresponding DNS request based on the threat detection technology such as Domain Generation Algorithm (DGA) detection and DNS tunnel attack detection according to the network connection information, and then obtain the detection result of whether the DNS request has a threat.

[0028] It can be understood that compared to collecting the network connection information required for DNS request detection through DNS logs (which are mainly output by the DNS server when performing domain name resolution), the embodiment of the present application introduces a kernel-state program (i.e., the first program) to the client to intercept information of the kernel function (i.e., the first kernel function) that needs to be called when the client initiates a DNS request, thereby realizing real-time collection of the network connection information at the place where the network connection information is generated, that is, in the kernel space of the client itself, thereby greatly improving the information collection efficiency in the DNS request monitoring process, and then independently realizing the DNS request detection function based on the network connection information through the user-state program (i.e., the second program) compiled by the user according to the actual threat detection needs, so as to realize real-time DNS request detection based on the real-time collected information, thereby relying on the collaboration between the first program and the second program, when the client initiates a large number of DNS requests, the efficiency of DNS request monitoring can be guaranteed.

[0029] By adopting the technical solution of the embodiment of the present application, by configuring the first program to intercept information of the first kernel function related to initiating the DNS request, the kernel-level collection function of the network connection information required for DNS request threat detection can be implemented, so that the information collection location is closer to the information generation location, thereby improving the information collection efficiency in the DNS request monitoring process, and then by configuring the second program to timely analyze the information collected by the first program to realize the threat detection function of the DNS request, thereby realizing efficient monitoring of the DNS request with the help of the collaboration between programs running at different working levels (i.e., kernel state and user state).

[0030] Reference Figure 2 As shown, a flowchart of another method for monitoring domain name system requests in an embodiment of the present application is shown. Figure 2 As shown, the method comprises the following steps:

[0031] Step S21: The first program collects network connection information associated with the DNS request by intercepting information obtained during the calling process of the first kernel function, wherein the first kernel function includes: a kernel function required to be called when the client initiates a DNS request.

[0032] In specific implementation, the first kernel function can be set according to the actual application scenario. For example, when the client initiates a DNS request based on the User Datagram Protocol (UDP), the kernel function udp_recvmsg used to receive UDP data can be intercepted as the first kernel function, and the collected data structure socket (which contains network communication parameters such as protocol type, port number, IP address, etc.), domain name and other information can be used as the network connection information associated with the DNS request.

[0033] Step S22: The first program obtains information of the first process.

[0034] The first process includes a process in which a DNS request has been initiated in the client.

[0035] In a specific implementation, when the first program obtains the information of the first process, it may obtain the identification information of the first process and / or obtain the description information of the first process.

[0036] For example, the first program can obtain the process identity document (PID), thread group identity document (TGID) and other identification information of the first process by calling the interface of the relevant kernel function, such as calling bpf_get_current_pid_tgid(); or, it can also obtain the command line, process name and other description information of the first process through the process descriptor (task_struct).

[0037] Step S23: The second program obtains a detection result of whether there is a threat in the DNS request by analyzing the network connection information associated with the DNS request.

[0038] In specific implementation, the second program can perform detection on the DNS request based on the network connection information, such as whether there is any access behavior to abnormal domain names (such as domain names constructed by malware based on DGA), thereby determining whether there is a threat in the DNS request.

[0039] Step S24: The second program determines the DNS request that contains threats based on the obtained detection results.

[0040] In specific implementation, the second program can determine whether the DNS request associated with the detection result is a threatening DNS request each time a detection result is obtained, and if the DNS request associated with the detection result is a threatening DNS request, execute step S25 to block the process of the threatening DNS request.

[0041] Alternatively, the second program may periodically summarize the recent detection results, and determine threatening DNS requests from relevant DNS requests based on the detection results obtained in each summary, and then execute step S25 to block the processes of these threatening DNS requests.

[0042] Step S25: The second program selects the process that initiates the threatening DNS request from the first process as the second process, and requests the first program to block the second process, wherein the first process includes the process that has initiated the DNS request in the client.

[0043] In specific implementation, the second program can find the malicious process (i.e., the second process) that initiated the threatening DNS request based on the identification information, description information, and other information of the first process, and block the malicious process, such as requesting the first program to terminate (kill) or pause (sleep) the malicious process, so as to interrupt the execution of the malicious process in time and achieve threat blocking. By introducing the threat blocking capability for DNS request monitoring, the spread and diffusion of malicious behavior can be effectively interrupted, the impact of malicious behavior on the network and data can be reduced, further DNS attacks and intrusions can be prevented, and the abuse of system resources by malicious processes can be stopped.

[0044] For example, the second program can inform the first program which processes need to be blocked through the function interface send_signal(), and the first program then sends the instruction FGS_SIGKILL to the relevant processes through the function interface send_signal() to terminate the relevant processes that initiate the threatening DNS, thereby achieving threat blocking.

[0045] In some embodiments, the first program includes: an extended Berkeley Packet Filter (eBPF) program set for the kernel function required for information interception; the kernel function required for information interception includes at least: the first kernel function.

[0046] In the specific implementation, a custom eBPF program can be set for the kernel function that needs to intercept information. For example, the interface of the kernel function that needs to intercept information can be used as the hook of the custom eBPF program in the first program. By making use of the event-driven nature of the eBPF program, when the interface of the relevant kernel function is called, the running of the custom eBPF program will be triggered accordingly. In this way, the interface call parameters and interface return parameters of the kernel function can be intercepted in time, and then the information obtained by the kernel function during the calling process can be intercepted in time, thereby further improving the efficiency of information collection.

[0047] It should be noted that eBPF is a technology that can run sandbox programs in the operating system kernel, which is used to safely and effectively expand the capabilities of the kernel without modifying the kernel code or loading kernel modules. The embodiment of the present application implements the relevant functions of the above-mentioned first program by writing an eBPF program, which can effectively reduce the difficulty of development.

[0048] In some embodiments, after detecting the network connection information associated with a threatening DNS request, the second program can generate an alarm message to remind the user to promptly process the threatening DNS request, and / or automatically generate a log based on the information associated with the threatening DNS request (such as network connection information, process information or request results, etc.), which can record the source, target, time and other information of the relevant malicious network connection for subsequent security analysis and auditing, thereby achieving reasonable optimization of network security strategies and threat blocking algorithms.

[0049] Reference Figure 3 As shown, a flowchart of another method for monitoring domain name system requests in an embodiment of the present application is shown. Figure 3 As shown, the method comprises the following steps:

[0050] Step S31: The first program collects network connection information associated with the DNS request by intercepting information obtained during the calling process of the first kernel function, wherein the first kernel function includes: a kernel function required to be called when the client initiates a DNS request.

[0051] Step S32: the first program collects first information, the first information including at least one of a request result of the DNS request and information of a first process, the first process including a process in the client that has initiated a DNS request.

[0052] Step S33: The second program obtains a detection result of whether there is a threat in the DNS request by analyzing the network connection information associated with the DNS request and the first information.

[0053] In a specific implementation, the second program can combine the network connection information and the first information to perform more comprehensive threat detection on the DNS request.

[0054] For example, the second program can determine whether the DNS request is subject to cache poisoning attacks and other related threats by detecting whether the request result is a forged domain name resolution result (such as whether it is a false IP address replaced by malware).

[0055] For another example, the second program may analyze the PID, command line and other information of the first process to find the first process that was previously marked as a malicious process, or find the first process that has similar descriptive information characteristics to the malicious process, and accordingly determine the DNS requests initiated by these first processes as threatening DNS requests.

[0056] In this embodiment, by additionally introducing the first information on the basis of the network connection information, the information based on which the DNS request detection is based is multidimensionalized, so that the second program can achieve more comprehensive threat detection for the DNA request.

[0057] As a possible implementation, the first program collects the request result of the DNS request by intercepting information obtained by the second kernel function during the calling process, and the second kernel function includes: the kernel function that needs to be called when the client receives the request result of the DNS request.

[0058] In specific implementation, the second kernel function can be set according to the actual application scenario. For example, when the first kernel function includes the kernel function udp_recvmsg, the kernel function kretprobe (which is used to perform related execution operations after udp_recvmsg is executed) can be used as the second kernel function to intercept information, so that the first program can collect the request results of the DNS request (such as domain name resolution results such as IP addresses).

[0059] It should be noted that different information obtained by the kernel function during the calling process usually carries different flag information. For example, when the flag information is 0, it indicates that the relevant data is query request data (corresponding to the interface call parameter); when the flag information is 1, it indicates that the relevant data is request response data (corresponding to the interface return parameter). When the first program intercepts information of the first kernel function and the second kernel function, it can distinguish the obtained query request data and request response data according to the flag information, so as to collect network connection information and request results for the query request data and request response data.

[0060] In some embodiments, before the above step S33, the method further includes:

[0061] Step S34: the first program matches the first information associated with the same process with the network connection information associated with the DNS request.

[0062] In specific implementation, the first program will match the network connection information associated with the DNS request initiated by the process with the request result of the DNS request received by the process and / or the information of the process (i.e., the first information). That is, the network connection information and the first information associated with the DNS request initiated by the same process are determined as mutually matching network connection information and the first information, so that the second program can subsequently comprehensively analyze the various information collected by the first program from the granularity of the DNS request (such as abnormal domain name detection at the DNS request level) or the granularity of the process (such as comparison of malicious process description information features at the process level).

[0063] Step S35: the first program combines the first information that matches each other with the network connection information associated with the DNS request, and sends the combined information to the second program.

[0064] In the specific implementation, the first program will splice the first information that matches each other and the network connection information associated with the DNS request, that is, the network connection information associated with the DNS request initiated by the same process, and the request result and / or process information, into one information, and send the spliced ​​information to the second program through data transmission methods between kernel state and user state such as memory copy and memory imaging.

[0065] Step S36: the second program filters the spliced ​​information.

[0066] In specific implementation, the second program can filter the spliced ​​information based on one or more information in the spliced ​​information. For example, the second program can filter the spliced ​​information related to the query of the intranet domain name based on the network connection information in the spliced ​​information, and / or the second program can filter the spliced ​​information associated with the process in the preset process whitelist based on the process information in the spliced ​​information.

[0067] The above step S33 includes:

[0068] Step S331: The second program obtains a detection result of whether there is a threat in the DNS request associated with each piece of information by analyzing each piece of filtered information.

[0069] In the specific implementation, the second process first filters the various information spliced ​​together by the first program, and after filtering out part of the spliced ​​information, analyzes the remaining spliced ​​information to perform threat detection on related DNS requests, thereby reducing the number of DNS requests required for threat detection and further improving the efficiency of DNS request monitoring.

[0070] In this embodiment, the second program performs overall filtering on the information spliced ​​by the first program, which can improve the richness of the information on which the second program can perform information filtering, thereby enabling the second program to flexibly support multiple filtering rules to perform information filtering.

[0071] In some embodiments, the method further comprises:

[0072] Step S37: The first program filters the currently collected information.

[0073] The currently collected information includes at least one of the currently collected network connection information and the currently collected first information.

[0074] In the specific implementation, after the first program collects one piece of information (or multiple pieces of information) at a certain moment (or within a set time period), it will filter the collected information. For example, if the first program collects network connection information associated with a DNS request at the current moment, it will filter the network connection information and filter out unnecessary network connection information (such as network connection information associated with domain names in a preset domain name whitelist).

[0075] Step S38: The first program determines the association relationship between the filtered information and the information in the cache of the first program according to whether they are associated with the same process.

[0076] The information in the cache of the first program includes information obtained by filtering previously collected information, and the previously collected information includes at least one of previously collected network connection information and previously collected first information.

[0077] In specific implementation, the first program will mark the information in the cache and the filtered information associated with the DNS request initiated by the same process as being associated (i.e., determining the association relationship between the two). Taking the above-mentioned filtered information as the request result of a DNS request initiated by a process as an example, the first process will query whether there is information associated with the process (such as network connection information, process information, etc.) in the cache, and if the information associated with the process exists in the cache, determine the association relationship between the request result and the information associated with the process in the cache, such as marking the storage location, index, and other information of the request result and the information associated with the process in the cache to indicate the association relationship between the two.

[0078] Step S39: The first program associates and stores the filtered information with the information in the cache according to the association relationship.

[0079] In a specific implementation, the first program finds the associated information in the cache for the filtered information according to the association relationship determined in the above steps, and stores the filtered information in the storage area where the associated information in the cache is located, or stores the filtered information together with the storage location, index and other information of the associated information in the cache in the same storage area in the cache, thereby realizing the associated storage between the filtered information and the associated information in the cache, so that the second program can subsequently comprehensively analyze the various information collected and filtered by the first program from the granularity of the DNS request or the granularity of the process.

[0080] For example, the first program can use the identification information of the process (such as PID, TGID, etc.) as the key and the information to be stored in the cache (such as filtered network connection information and the first information) as the value, and store the information collected and filtered by the first program in the cache in the form of key-value pairs. When the first program subsequently stores the filtered information, it can add the filtered information to the value of the associated key to achieve associated storage between the filtered information and the associated information in the cache.

[0081] The above step S33 includes:

[0082] Step S332: The second program obtains a detection result of whether there is a threat in the DNS request by analyzing the information associated and stored in the cache of the first program.

[0083] In specific implementation, the second process can actively access the cache of the first program to obtain the above-mentioned associated storage information, or the first program can actively send the associated storage information in the cache to the second process after splicing, and clear the data in the cache that has been sent to the second program. After obtaining the associated storage information, the second process analyzes the associated storage information to detect related DNS requests, thereby reducing the number of DNS requests that need to be detected, thereby further improving the efficiency of DNS request monitoring.

[0084] In this embodiment, the first program can perform filtering after collecting the information, so that the filtering time of the information is closer to the information collection time, thereby improving the filtering efficiency of the information.

[0085] Optionally, the cache of the first program uses a least recently used (Least Recently Used, LRU) cache elimination mechanism to store information.

[0086] In specific implementation, a LRU cache elimination mechanism can be implemented by setting a hash table in the cache. The hash table can be a key-value pair data structure so as to associate and store the data (i.e., data items) collected by the first program. For example, the first program can use the process identification information (such as PID, TGID, etc.) as a key (which is used to substitute into the hash function to obtain the address of the relevant value in the hash table), and the information required to be stored in the cache (such as filtered network connection information and the first information) as a value, thereby realizing associated storage of the information collected and filtered by the first program in the cache based on the hash table.

[0087] The LRU-based cache eviction mechanism can maintain a list of recently accessed data items in a hash table (whose capacity is limited), and keep the recently accessed data items at the front of the list of recently accessed data items, so as to achieve efficient data storage and access in the kernel (especially for data that is frequently accessed and operated in the kernel); when the data stored in the hash table exceeds its capacity limit, the least recently used data item is automatically eliminated to make room for new data.

[0088] For example, a hit count can be added to each data item in the hash table (or called cache item, such as the network connection information and first information stored in association with a single process). When the data stored in the hash table exceeds its capacity limit, all cache items are scanned to find the item with the least hit count and delete it. For example, the cache item associated with a process with the least access count (which is used to store the network connection information and first information associated with the process) is deleted from the hash table.

[0089] For another example, a list of recently accessed data items is maintained through a linked list. When accessing data, the value corresponding to the key is searched in the hash table through the function int get(int key), and the corresponding node is found in the linked list, and the node is moved to the head of the linked list; when adding data (such as adding network connection information and first information associated with a process), the value corresponding to the key is updated in the hash table through void set(int key, int value). If the relevant key is not found in the hash table, a new item is added to both the hash table and the linked list, and the new item is placed at the head of the linked list. If the data stored in the hash table exceeds its capacity limit, an item is deleted from the tail of the linked list, and the corresponding item is deleted from the hash table.

[0090] In this embodiment, with the help of the LRU concept (that is, the pages that were frequently used before are likely to be frequently used in the future, and conversely, the pages that have not been used for a long time are likely not to be used for a long time in the future), the data access and storage in the kernel are optimized to further improve the efficiency of DNS request monitoring.

[0091] In some embodiments, the above step S12 includes:

[0092] Step S121: The second program detects whether there is threat intelligence matching the network connection information associated with the DNS request based on a pre-established threat intelligence library.

[0093] The threat intelligence library includes multiple threat intelligences, and one threat intelligence includes at least one network connection information marked as a threat. For example, a threat intelligence includes: network connection information marked as a mining pool (which refers to a platform that combines a small amount of computing power to operate jointly to obtain block rewards provided by the network), and network connection information marked as a related machine suspected of being infected with a high-risk Trojan.

[0094] Optionally, depending on actual needs, a threat intelligence may also include information about a process associated with the network connection information or a request result of an associated DNS request.

[0095] In specific implementation, threat intelligence from different sources (such as public threat intelligence sources, private threat intelligence sources, or internal threat detection systems, etc.) can be collected in advance to establish a threat intelligence library, and a Hypertext Transfer Protocol (HTTP) interface is configured for the threat intelligence library as a query interface.

[0096] The second program can query whether there is threat intelligence in the threat intelligence library through the above-mentioned query interface that matches the network connection information collected by the first program; or the second program can report the network connection information to the query server, and the query server queries whether there is matching threat intelligence in the threat intelligence library through the above-mentioned query interface or a processing program (such as a kafka message processing bus) configured with the above-mentioned query interface, and returns the query result to the second program.

[0097] For example, for the network connection information A reported by the second program, the query server finds that the network connection information of the threat intelligence B in the threat intelligence library is the same as the network connection information A, then the threat intelligence B is returned to the second program, and the second program then determines that there is matching threat intelligence based on the query result.

[0098] Step S122: In the case where there is threat intelligence matching the network connection information associated with the DNS request, the second program determines that the detection result of the DNS request is that a threat exists.

[0099] In the specific implementation, if the network connection information associated with a DNS request matches a certain threat intelligence, it means that the DNS request is very likely to have dangerous access behaviors such as access to malicious domain names. The second program accordingly determines that the detection result of the DNS request is a threat, so as to subsequently perform operations such as issuing an alarm (such as sending an alarm email) or blocking the process for the threatening DNS request.

[0100] In this embodiment, with the help of threat intelligence pre-collected by the threat intelligence library, the occupation of computing resources of the second program by algorithm-based DNS request detection such as DGA detection can be avoided, thereby improving the threat detection efficiency of the second program for DNS requests, thereby ensuring the monitoring efficiency of DNS requests.

[0101] As a possible implementation, the above step S121 includes:

[0102] Step S1211: The second program detects, based on the threat intelligence library, whether there is threat intelligence that matches the network connection information associated with the DNS request and is within a valid period.

[0103] The validity period of the threat intelligence is determined according to the time when the threat intelligence is first collected and / or the time when it is last updated.

[0104] In specific implementation, after the threat intelligence library collects a certain threat intelligence from a certain threat intelligence source or a certain threat detection system, it will determine whether the threat intelligence has the same specific information as a certain threat intelligence stored in the threat intelligence library (such as having the same query domain name or the same request result, etc.). If the threat intelligence has the same specific information as a certain threat intelligence stored in the threat intelligence library, the stored threat intelligence is updated according to the threat intelligence (if the information of the two is the same, it is updated by overwriting or maintaining), and the time when the stored threat intelligence is updated is recorded; if the threat intelligence does not have the same specific information as any threat intelligence stored in the threat intelligence library, the threat intelligence is directly stored in the threat intelligence library, and the collection time of the threat intelligence is recorded as the earliest collection time.

[0105] The threat intelligence library can then determine the validity period of each threat intelligence in the threat intelligence library based on actual business needs (such as the pre-set security level) and the earliest time the threat intelligence was collected and / or the latest time it was updated. For example, in a business scenario with a higher security level, the threat intelligence library can determine the threat intelligence that was first collected within the last 20 years as threat intelligence within the validity period to ensure that the number of threat intelligence participating in DNS request detection is sufficient, thereby ensuring the reliability of DNS request detection; in a business scenario with a lower security level, the threat intelligence library can determine the threat intelligence that was last updated (and / or earliest collected) within the last month as threat intelligence within the validity period to reduce the number of threat intelligence participating in DNS request detection, thereby improving the efficiency of DNS request detection.

[0106] In this embodiment, the user can flexibly determine the validity period based on the time when the threat intelligence was first collected and / or the time when it was last updated to control the amount of threat intelligence involved in DNS request detection, thereby making the detection of DNS requests more in line with actual business needs.

[0107] In some embodiments, after the above step S11, the method further includes:

[0108] Step S13: The second program matches the network connection information associated with the DNS request with the network connection information associated with the historical DNS requests of the client.

[0109] In specific implementation, the second program will record the client's DNS access behavior in the recent period, such as recording the network connection information associated with the DNS requests initiated by the client in the past seven days, and match the network connection information associated with the DNS request currently to be detected with the network connection information associated with the DNS request initiated by the client in the past seven days (i.e., the network connection information associated with the historical DNS requests).

[0110] Step S14: When the network connection information associated with the DNS request does not match the network connection information associated with the historical DNS requests of the client, the second program determines the DNS request as a DNS request with potential threats and issues an early warning for the DNS request with potential threats.

[0111] In specific implementation, if the network connection information associated with the DNS request currently required to be detected does not match the network connection information associated with the historical DNS request, it means that the DNS access behavior associated with the DNS request currently required to be detected does not match the historical DNS access behavior of the client. For example, the DNS request currently required to be detected may query a domain name that has not been queried historically. This new DNS access behavior usually has a greater risk of being attacked by malware. Therefore, the second program will determine the DNS request as a DNS request with potential threats and issue an early warning to remind the user to pay attention to the potential risks of the DNS request.

[0112] In some embodiments, the above step S12 includes:

[0113] Step S124: the second program detects whether the domain name in the network connection information associated with the DNS request is an abnormal domain name according to a pre-configured domain name identification model or domain name identification rule.

[0114] In specific implementation, a large amount of domain name data can be collected in advance, including normal domain name data and abnormal domain name data (such as domain names generated by DGA generation mode) to construct a training data set and a verification data set of domain names. And key features such as length, character composition, character frequency, character arrangement, etc. can be further extracted from the domain name data to train the domain name recognition model or construct domain name recognition rules.

[0115] Optionally, before training the domain name recognition model or constructing the domain name recognition rules, the domain name data may be preprocessed by removing invalid domain names, marking domain name types (normal domain names or abnormal domain names), and converting domain names into a form that can be used for feature extraction and training. The above key features are then extracted from the preprocessed domain name data to train the domain name recognition model or construct the domain name recognition rules.

[0116] For example, a machine learning model such as a support vector machine (SVM), random forest (RandomForest) or deep learning model can be used, and the key features extracted from the preprocessed domain name data are used as the model input, and the corresponding marked domain name type (normal domain name or abnormal domain name) is used as the expected output of the model. The machine learning model is trained to obtain a classifier (i.e., a domain name recognition model) for determining whether a domain name is an abnormal domain name.

[0117] For another example, a series of rules (i.e., domain name recognition rules) can be constructed based on the DGA generation pattern or other rules to detect abnormal patterns of key features such as domain name length, character composition, character frequency, and character arrangement. For example, after analyzing the domain name length extracted from the domain name data associated with the DGA generation pattern, it is determined that the domain names generated based on the DGA generation pattern are usually shorter. Subsequently, the domain name length lower than the set threshold can be used as a domain name recognition rule for detecting an abnormal pattern of the domain name length.

[0118] Optionally, a validation data set may be used to evaluate the trained model or constructed rules, so as to measure the detection performance of the trained model or constructed rules through performance indicators such as detection accuracy and recall rate, and make adjustments.

[0119] Step S125: When the domain name in the network connection information associated with the DNS request is an abnormal domain name, the second program determines that the detection result of the DNS request is that a threat exists.

[0120] In specific implementation, if the domain name in the network connection information associated with the DNS request is an abnormal domain name, it means that the DNS request is more likely to access the domain name generated by the algorithm (this type of domain name is usually used by malware and can easily become an attack path for malware, and may also indicate that the relevant virtual machine has been stolen). The second program will accordingly determine that the DNS request is a threatening DNS request so that the DNS request can be processed subsequently by means of alarms or process blocking.

[0121] In this embodiment, the second program can accurately screen out DNS requests for accessing abnormal domain names through a pre-configured domain name recognition model or domain name recognition rule, thereby facilitating timely prevention and processing of malware attacks or threats of related virtual machines being stolen.

[0122] In some embodiments, after the above step S11, at least one of the following step S15 and the following step S16 is further included, wherein:

[0123] Step S15: the first program sends the network connection information associated with the DNS request to the second program, and the second program filters the network connection information associated with the DNS request according to a set filtering rule.

[0124] In specific implementation, the first program can send the collected network connection information directly to the second program, or splice the network connection information with other information (such as the first information mentioned above) and then send it to the second program. The second program then filters the received network connection information or the spliced ​​information containing the network connection information according to the set filtering rules.

[0125] Step S16: The first program filters the network connection information associated with the DNS request according to the set filtering rules, and sends the filtered network connection information associated with the DNS request to the second program.

[0126] In the specific implementation, each time the first program collects network connection information associated with a DNS request, it will filter the network connection information according to the set filtering rules, and send the filtered network connection information directly to the second program, or splice the filtered network connection information with other associated information (such as the first information mentioned above) before sending it to the second program.

[0127] The above step S12 includes:

[0128] Step S126: The second program obtains a detection result of whether the DNS request contains a threat by analyzing the network connection information associated with the filtered DNS request.

[0129] In specific implementation, the second program analyzes the remaining network connection information after filtering by the first program and / or the second program to detect related DNS requests, thereby reducing the number of DNS requests that need to be detected and further improving the efficiency of DNS request monitoring.

[0130] Optionally, the filtering rule according to which the relevant program (such as the first program or the second program) performs filtering may include at least one of the following:

[0131] Item A-1: ​​Filter out information associated with intranet DNS requests;

[0132] Item A-2: Filter out information associated with operation and maintenance DNS requests.

[0133] For item A-1, the relevant program can filter out information containing intranet domain names (such as network connection information) to filter out information associated with intranet DNS requests.

[0134] For item A-2, the relevant program can filter out information that matches the preset whitelist information (such as designated operation and maintenance users, designated operation and maintenance containers, designated operation and maintenance domain names, etc.). For example, the relevant program can filter out information (such as network connection information) containing namespaces, user accounts (User Identification, UID) or domain names associated with the operation and maintenance business, so as to filter out information associated with the operation and maintenance DNS requests.

[0135] In this embodiment, considering that access to the intranet or operation and maintenance services is usually not threatened by malware, the embodiment of the present application chooses to filter out the information associated with the specified intranet DNS request or operation and maintenance DNS request to further improve the efficiency of DNS request detection.

[0136] In some embodiments, before the above step S11, the method further includes:

[0137] Step S41: Each time the client initiates a DNS request, the first program intercepts the information obtained during the calling process of the first kernel function, and periodically records the number of calls of the first kernel function.

[0138] In specific implementation, the first program may periodically record the number of calls to the first kernel function by setting a counter, a timer, or the like.

[0139] For example, the first program can maintain a counter and determine a starting recording timestamp. Subsequently, when the interval between the current timestamp and the starting recording timestamp is less than a time threshold (such as 1 second) (i.e., within a cycle), when the first kernel function is called, the first program will intercept the first kernel function to collect relevant information and increase the counter value by one; when the interval between the current timestamp and the starting recording timestamp reaches the time threshold, the first program will clear the counter value and determine a new starting recording timestamp (i.e., enter a new cycle) to repeat the above counting operation, thereby periodically recording the number of calls to the first kernel function.

[0140] Step S42: The first program determines whether the number of calls to the first kernel function recorded in the current cycle is greater than a set number threshold.

[0141] In the specific implementation, the first program measures the frequency of the client's initiation of DNS requests by determining whether the number of calls to the first kernel function recorded in the current cycle is greater than a set threshold (such as one thousand times), so that when the client's initiation frequency of DNS requests is too high, relevant processing operations can be performed in a timely manner.

[0142] Step S43: When the number of calls of the first kernel function recorded in the current cycle is greater than the set number threshold, the first program no longer intercepts the information obtained during the calling process of the first kernel function in the current cycle.

[0143] In specific implementation, if the number of calls to the first kernel function recorded in the current cycle is greater than the set threshold number, it means that the client's initiation frequency of DNS requests is too high. The first program immediately starts DNS message frequency limiting in the current cycle, that is, stops intercepting information of the first kernel function in the current cycle to prevent excessively frequent information collection from affecting the normal operation of related business services of the client. When entering the next cycle, the first program turns off DNS message frequency limiting and continues to intercept information of the first kernel function to achieve efficient monitoring of DNS requests.

[0144] In some embodiments, the above step S11 includes:

[0145] Step S111: the first program intercepts information obtained during the calling process of the first kernel function.

[0146] In specific implementation, the first program may use kernel functions such as udp_recvmsg as the first kernel function to intercept information, so as to obtain information such as UDP data acquired by the first kernel function.

[0147] Step S112: The first program filters out data matching the port to be accessed by the DNS request from the intercepted information, and determines the filtered data as the network connection information associated with the DNS request.

[0148] In specific implementation, the port required to be accessed by the DNS request can be determined according to the actual application scenario. For example, considering that the port number of DNS is usually 53 or 5353, the relevant information of the target port (i.e., the accessed port) with the port number of 53 or 5353 can be filtered out from the information obtained during the calling process of the first kernel function, so as to quickly obtain the network connection information associated with the DNS request.

[0149] In this embodiment, by quickly filtering the information obtained by intercepting the first kernel function through the port, the collection efficiency of the network connection information associated with the DNS request can be further guaranteed.

[0150] It should be noted that, for the method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present application are not limited by the described order of actions, because according to the embodiments of the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present application.

[0151] Figure 4 : is a schematic diagram of a domain name system request monitoring device according to an embodiment of the present application, the device comprising:

[0152] A first collection module is used to collect network connection information associated with a domain name system DNS request by intercepting information obtained during the calling process of a first kernel function, wherein the first kernel function includes: a kernel function that needs to be called when the client initiates a DNS request;

[0153] The first detection module is used to obtain a detection result of whether the DNS request poses a threat by analyzing the network connection information associated with the DNS request.

[0154] By adopting the technical solution of the embodiment of the present application, by configuring the first program to intercept information of the first kernel function related to initiating the DNS request, the kernel-level collection function of the network connection information required for DNS request threat detection can be implemented, so that the information collection location is closer to the information generation location, thereby improving the information collection efficiency in the DNS request monitoring process, and then by configuring the second program to timely analyze the information collected by the first program to realize the threat detection function of the DNS request, thereby realizing efficient monitoring of the DNS request with the help of the collaboration between programs running at different working levels (i.e., kernel state and user state).

[0155] Optionally, the device further comprises:

[0156] A first processing module, configured to determine a DNS request that has a threat according to the obtained detection result;

[0157] The first blocking module is used to filter out the process that initiates the threatening DNS request from the first process as the second process, and request the first program to block the second process, wherein the first process includes the process that has initiated the DNS request in the client.

[0158] Optionally, the device further comprises:

[0159] A second collection module is used to collect first information, where the first information includes at least one of a request result of the DNS request and information of a first process, where the first process includes a process in the client that has initiated the DNS request;

[0160] The first detection module comprises:

[0161] The first detection submodule is used to obtain a detection result of whether the DNS request poses a threat by analyzing the network connection information associated with the DNS request and the first information.

[0162] Optionally, the device further comprises:

[0163] A first matching module, used to match the first information associated with the same process with the network connection information associated with the DNS request;

[0164] A first sending module, used for splicing the first information that matches each other and the network connection information associated with the DNS request, and sending the spliced ​​information to the second program;

[0165] A first filtering module, used for filtering each piece of information that has been spliced;

[0166] The first detection module comprises:

[0167] The second detection submodule is used to obtain a detection result of whether a DNS request associated with each piece of information is threatening by analyzing each piece of filtered information.

[0168] Optionally, the device further comprises:

[0169] A second filtering module, used to filter the currently collected information, where the currently collected information includes at least one of the currently collected network connection information and the currently collected first information;

[0170] A first processing module, configured to determine an association relationship between the filtered information and information in a cache of the first program according to whether they are associated with the same process, wherein the information in the cache of the first program includes information obtained after filtering previously collected information, wherein the previously collected information includes at least one of previously collected network connection information and previously collected first information;

[0171] A first storage module, used for associating and storing the filtered information with the information in the cache according to the association relationship;

[0172] The first detection module comprises:

[0173] A third detection submodule, configured to obtain a detection result of whether the DNS request is a threat by analyzing the information associated and stored in the cache of the first program;

[0174] The cache of the first program uses a least recently used cache elimination mechanism to store information.

[0175] Optionally, the first information includes a request result of the DNS request; and the second collection module includes:

[0176] The third collection module is used to collect the request result of the DNS request by intercepting the information obtained during the calling process of the second kernel function, and the second kernel function includes: the kernel function that needs to be called when the client receives the request result of the DNS request.

[0177] Optionally, the first detection module includes:

[0178] A fourth detection submodule, configured to detect whether there is threat intelligence matching the network connection information associated with the DNS request according to a pre-established threat intelligence library, wherein the threat intelligence library includes a plurality of threat intelligence reports, and one of the threat intelligence includes a network connection information marked as having a threat;

[0179] The fifth detection submodule is used to determine that the detection result of the DNS request is that a threat exists when there is threat intelligence matching the network connection information associated with the DNS request.

[0180] Optionally, the fourth detection submodule includes:

[0181] A sixth detection submodule, configured to detect, based on the threat intelligence library, whether there is threat intelligence that matches the network connection information associated with the DNS request and is within a validity period;

[0182] The validity period of the threat intelligence is determined according to the time when the threat intelligence is first collected and / or the time when it is last updated.

[0183] Optionally, the device further comprises:

[0184] A second matching module, used to match the network connection information associated with the DNS request with the network connection information associated with the historical DNS requests of the client;

[0185] The first warning module is used to, when the network connection information associated with the DNS request does not match the network connection information associated with the historical DNS requests of the client, the second program determines the DNS request as a DNS request with potential threats and issues a warning for the DNS request with potential threats.

[0186] Optionally, the first detection module includes:

[0187] A second detection module is used to detect whether the domain name in the network connection information associated with the DNS request is an abnormal domain name according to a pre-configured domain name recognition model or domain name recognition rule;

[0188] The third detection module is used to determine that the detection result of the DNS request is a threat when the domain name in the network connection information associated with the DNS request is an abnormal domain name.

[0189] Optionally, the device further comprises at least one of the following:

[0190] A second processing module, used for sending the network connection information associated with the DNS request, and filtering the network connection information associated with the DNS request according to a set filtering rule;

[0191] A third processing module, configured to filter the network connection information associated with the DNS request according to a set filtering rule, and send the filtered network connection information associated with the DNS request;

[0192] The first detection module comprises:

[0193] a seventh detection submodule, configured to obtain a detection result of whether the DNS request is a threat by analyzing the network connection information associated with the filtered DNS request;

[0194] The filtering rules set include at least one of the following:

[0195] Filter out information associated with intranet DNS requests;

[0196] Filter out information associated with operation and maintenance DNS requests.

[0197] Optionally, the device further comprises:

[0198] a fourth processing module, configured to intercept information obtained during the calling process of the first kernel function each time the client initiates a DNS request, and periodically record the number of calls of the first kernel function;

[0199] A first judgment module is used to judge whether the number of calls of the first kernel function recorded in the current cycle is greater than a set number threshold;

[0200] The fifth processing module is used to, when the number of calls of the first kernel function recorded in the current cycle is greater than the set number threshold, the first program no longer intercepts the information obtained during the calling process of the first kernel function in the current cycle.

[0201] Optionally, the first acquisition module includes:

[0202] A first acquisition submodule, used for intercepting information obtained during the calling process of the first kernel function;

[0203] The first screening module is used to screen out data matching the port required to be accessed by the DNS request from the intercepted information, and determine the screened data as the network connection information associated with the DNS request.

[0204] Optionally, the device further comprises:

[0205] The first generating module is used to generate alarm information and / or logs according to the network connection information associated with the detected DNS request with threats.

[0206] It should be noted that the device embodiment is similar to the method embodiment, so the description is relatively simple, and the relevant parts can be referred to the method embodiment.

[0207] The present application also provides an electronic device, such as Figure 5As shown, it includes a processor 501, a communication interface 502, a memory 503 and a communication bus 504, wherein the processor 501, the communication interface 502, and the memory 503 communicate with each other through the communication bus 504.

[0208] Memory 503, used for storing computer programs;

[0209] The processor 501 is used to execute the program stored in the memory 503, such as the steps of the domain name system request monitoring method disclosed in the embodiment of the present application.

[0210] The communication bus mentioned in the above terminal can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0211] The communication interface is used for communication between the above terminal and other devices.

[0212] The memory may include a random access memory (RAM) or a non-volatile memory (non-volatile memory), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0213] The above-mentioned processor can be a general-purpose processor, including a central processing unit, a network processor (Network Processor, NP), etc.; it can also be a digital signal processor (Digital Signal Processing, DSP), an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0214] The embodiment of the present application also provides a computer-readable storage medium on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, the domain name system request monitoring method disclosed in the embodiment of the present application is implemented.

[0215] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive Solid State Disk (SSD)), etc.

[0216] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0217] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0218] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application are included in the protection scope of the present application.

Claims

1. A method for monitoring domain name system requests, characterized in that: The method is executed by a target program configured on a client, wherein the target program includes a first program running in a kernel state and a second program running in a user state, and the method includes: The first program collects network connection information associated with a domain name system DNS request by intercepting information obtained during the calling process of the first kernel function, wherein the first kernel function includes: a kernel function required to be called when the client initiates a DNS request; The second program obtains a detection result of whether the DNS request poses a threat by analyzing the network connection information associated with the DNS request.

2. The method according to claim 1, characterized in that After the second program obtains a detection result of whether the DNS request contains a threat by analyzing the network connection information associated with the DNS request, the method further includes: The second program determines the DNS request with threats according to the obtained detection result; The second program selects the process that initiates the threatening DNS request from the first process as the second process, and requests the first program to block the second process, wherein the first process includes the process that has initiated the DNS request in the client.

3. The method according to claim 1, characterized in that The method further comprises: The first program collects first information, the first information including at least one of a request result of the DNS request and information of a first process, the first process including a process in the client that has initiated a DNS request; The second program obtains a detection result of whether the DNS request has a threat by analyzing the network connection information associated with the DNS request, including: The second program obtains a detection result of whether the DNS request poses a threat by analyzing the network connection information associated with the DNS request and the first information.

4. The method according to claim 3, characterized in that Before the second program obtains a detection result of whether the DNS request is a threat by analyzing the network connection information associated with the DNS request and the first information, the method further includes: The first program matches the first information associated with the same process with the network connection information associated with the DNS request; The first program combines the first information that matches each other with the network connection information associated with the DNS request, and sends the combined information to the second program; The second program filters each piece of information that has been spliced; The second program obtains a detection result of whether the DNS request has a threat by analyzing the network connection information associated with the DNS request and the first information, including: The second program obtains a detection result of whether a DNS request associated with each piece of information has a threat by analyzing each piece of filtered information.

5. The method according to claim 3, characterized in that: The method further comprises: The first program filters the currently collected information, wherein the currently collected information includes at least one of the currently collected network connection information and the currently collected first information; The first program determines, according to whether they are associated with the same process, an association relationship between the filtered information and information in a cache of the first program, wherein the information in the cache of the first program includes information obtained by filtering previously collected information, and the previously collected information includes at least one of previously collected network connection information and previously collected first information; The first program associates and stores the filtered information with the information in the cache according to the association relationship; The second program obtains a detection result of whether the DNS request has a threat by analyzing the network connection information associated with the DNS request and the first information, including: The second program obtains a detection result of whether the DNS request is a threat by analyzing the information associated and stored in the cache of the first program; The cache of the first program uses a least recently used cache elimination mechanism to store information.

6. The method according to claim 3, characterized in that The first information includes a request result of the DNS request; The first program collects first information, including: The first program collects the request result of the DNS request by intercepting the information obtained by the second kernel function during the calling process, and the second kernel function includes: the kernel function that needs to be called when the client receives the request result of the DNS request.

7. The method according to claim 1, characterized in that The second program obtains a detection result of whether the DNS request has a threat by analyzing the network connection information associated with the DNS request, including: The second program detects whether there is threat intelligence matching the network connection information associated with the DNS request according to a pre-established threat intelligence library, wherein the threat intelligence library includes a plurality of threat intelligence reports, and one of the threat intelligence includes a network connection information marked as having a threat; In the event that there is threat intelligence matching the network connection information associated with the DNS request, the second program determines that the detection result of the DNS request is that a threat exists.

8. The method according to claim 7, characterized in that The second program detects whether there is threat intelligence matching the network connection information associated with the DNS request according to a pre-established threat intelligence library, including: The second program detects, based on the threat intelligence library, whether there is threat intelligence that matches the network connection information associated with the DNS request and is within a valid period; The validity period of the threat intelligence is determined according to the time when the threat intelligence is first collected and / or the time when it is last updated.

9. The method according to claim 1, characterized in that: After the first program collects network connection information associated with a domain name system DNS request by intercepting information obtained during the calling process of the first kernel function, the method further includes: The second program matches the network connection information associated with the DNS request with the network connection information associated with the historical DNS requests of the client; When the network connection information associated with the DNS request does not match the network connection information associated with the historical DNS requests of the client, the second program determines the DNS request as a DNS request with potential threats and issues an early warning for the DNS request with potential threats.

10. The method according to claim 1, characterized in that The second program obtains a detection result of whether the DNS request has a threat by analyzing the network connection information associated with the DNS request, including: The second program detects whether the domain name in the network connection information associated with the DNS request is an abnormal domain name according to a preconfigured domain name identification model or domain name identification rule; In a case where the domain name in the network connection information associated with the DNS request is an abnormal domain name, the second program determines that the detection result of the DNS request is that a threat exists.

11. The method according to claim 1, characterized in that: After the first program collects network connection information associated with a domain name system DNS request by intercepting information obtained during the calling process of the first kernel function, the method further includes: The first program sends the network connection information associated with the DNS request to the second program, and the second program filters the network connection information associated with the DNS request according to a set filtering rule; And / or, the first program filters the network connection information associated with the DNS request according to a set filtering rule, and sends the filtered network connection information associated with the DNS request to the second program; The second program obtains a detection result of whether the DNS request has a threat by analyzing the network connection information associated with the DNS request, including: The second program obtains a detection result of whether the DNS request contains a threat by analyzing the network connection information associated with the filtered DNS request; The filtering rules set include at least one of the following: Filter out information associated with intranet DNS requests; Filter out information associated with operation and maintenance DNS requests.

12. The method according to claim 1, characterized in that Before the first program collects the network connection information associated with the domain name system DNS request by intercepting the information obtained during the calling process of the first kernel function, the method further includes: The first program intercepts information obtained during the calling process of the first kernel function each time the client initiates a DNS request, and periodically records the number of calls of the first kernel function; The first program determines whether the number of calls of the first kernel function recorded in the current cycle is greater than a set number threshold; When the number of calls of the first kernel function recorded in the current cycle is greater than the set number threshold, the first program no longer intercepts the information obtained during the calling process of the first kernel function in the current cycle.

13. The method according to claim 1, characterized in that The first program collects network connection information associated with a domain name system DNS request by intercepting information obtained during the calling process of the first kernel function, including: The first program intercepts information obtained during the calling process of the first kernel function; The first program filters out data matching the port required to be accessed by the DNS request from the intercepted information, and determines the filtered data as the network connection information associated with the DNS request.

14. The method according to any one of claims 1 to 13, characterized in that: The first program includes: an extended Berkeley packet filter eBPF program set for the kernel function required for information interception; the kernel function required for information interception includes at least: the first kernel function.

15. The method according to any one of claims 1 to 13, characterized in that: After the second program obtains a detection result of whether the DNS request contains a threat by analyzing the network connection information associated with the DNS request, the method further includes: The second program generates warning information and / or logs according to the network connection information associated with the detected threatening DNS request.

16. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; The processor is used to implement the domain name system request monitoring method according to any one of claims 1 to 15 when executing the program stored in the memory.

17. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the domain name system request monitoring method according to any one of claims 1 to 15 is implemented.

Images