Bypass test method of domain name access control strategy, storage medium and equipment

Abstract

The invention discloses a bypassing test method of a domain name access control strategy, a storage medium and equipment. The method comprises the following steps: issuing encrypted contrl-server-ip information in a well-known public server and a cloud server; and the test machine obtains the encrypted information and decrypts the encrypted information to obtain the contrl-server-ip, and an attack instruction is obtained. And the domain name security protection strategy of the gateway equipment is adjusted until the communication blocking between the malware and the controller-server-ip is realized, and the communication between the host machine of the malware and the well-known public server or the cloud server is not influenced. According to the method, the problems that a gateway product recognizes methods such as a general DGA domain name and bypasses a domain name protection filtering strategy after threat intelligence information is collected are solved, the effect of detecting whether the gateway product takes effect on a malicious domain name protection strategy or not is achieved, the network protection level is enhanced, and good practicability is achieved.

Description

Technical Field

[0001] The present invention belongs to the technical field of domain name security protection, and specifically relates to a domain name access control policy bypass test method, storage medium and device. Background Art

[0002] As the Internet has grown, cyberattacks and malicious behavior have also increased. Domain name access control is a network security measure used to limit access to websites on specific domain names to reduce potential attack risks. In a home environment, domain name access control can be used to filter content that is not suitable for children and ensure the security of the home network. This control can be achieved by blocking or limiting access to specific domain names. Some domain name access control implementations also involve privacy and data security. Controlling access to specific domain names can help protect user privacy and prevent sensitive information from leaking to unauthorized websites. Domain name access control was born to meet the needs of network security, resource management, compliance, content filtering, and privacy protection. It is part of the network management and security strategy and helps ensure the stability and security of the network environment.

[0003] Currently, most domain name access control technologies use intelligence libraries or domain name blacklists to intercept. Domain name access control technology needs to be verified by testing technology, but the testing methods are not sufficient. With the birth of modern random domain name generation technologies such as DGA, domain name access control technology is stretched, but a number of DGA identification technologies have also appeared on the network. Most of them are used to detect whether the domain name string is a random string, but the detection methods for secondary sub-C&C server IP transmission based on servers with well-known domain names and well-known IPs, private public network IPs and other transit servers are still limited. At present, the corresponding testing technology is only tested according to the original traditional testing technology, that is: to protect and intercept a certain domain name, directly block the corresponding domain name or the corresponding IP address, and test it in this way, resulting in missed tests. The existing technology mainly detects and identifies traditional DGA algorithms, for example: Existing patent 2023111519336 provides a DGA domain name detection method and system based on DNS message parsing, the method includes: online collection of DNS messages; parsing DNS messages to obtain domain names and response results; calculating the information entropy of the second-level domain name in the response message based on the Markov chain, and judging suspicious domain names based on the information entropy value; filtering the response message with the result that the domain name does not exist (NXDOMAIN), recording the client of its request, and judging the suspicious host; combining the domain name information entropy detection result and the NXDOMAIN response analysis result, judging the suspicious host, and issuing an alarm according to the alarm strategy. The method of the embodiment of the present application can perform online real-time analysis and detection of large traffic, has a wider applicability, and can more effectively detect domain names generated according to DGA.

[0004] Existing patent 2023102147508 involves a method, system and readable medium for identifying DGA domain names. The identification method includes: collecting a domain name sample data set, and dividing it into a DGA domain name sample data set and a normal domain name sample data set according to the domain name type; S2, performing feature engineering on the domain name sample data set to obtain domain name feature data; based on the domain name sample data set, selecting a basic sample, and establishing a triple based on the basic sample to obtain a triple data set; combining the basic sample and its domain name type label to form a supervised domain name sample; inputting the domain name feature data, the triple data set and the supervised domain name sample into a hybrid feature model for training to obtain a domain name identification model; S3, respectively inputting the domain name sample to be identified and its corresponding domain name feature data into the domain name identification model to output the domain name type of the domain name sample to be identified. The present invention realizes the effective identification of DGA domain names, which is convenient for intercepting and preventing access to DGA domain names.

[0005] Secondly, when configuring a malicious domain name blocking policy on the firewall, the domain name set cannot include well-known website domain names, because these well-known websites are legitimate websites and not malicious websites.

[0006] Regarding the method of configuring malicious URL blocking policy on the firewall, the URL set cannot include well-known website domain names, because these well-known websites are legitimate websites, not malicious websites.

[0007] For the firewall configuration of malicious IP blacklist blocking strategy method, the IP set cannot include well-known website IPs, because these well-known websites are legitimate websites, not malicious websites. The IP here is not known, and can only be configured with IPs that have been marked as malicious websites or malicious addresses in the network.

[0008] Therefore, the present invention designs a new method for testing domain name access control. The present invention tests the effectiveness of the DGA recognition method of the existing network device after optimizing the DGA. The probability of bypassing the domain name access control by this method is very high, breaking the traditional testing method. Once the domain name effective interception technology of the attack method is realized, the user's security level will have a qualitative leap, and the network will become more secure. After testing by this method, the interception effect of the gateway device on C&C attacks will be greatly enhanced, making the network more secure. Summary of the invention

[0009] The purpose of the present invention is to provide a bypass test method, storage medium and device for domain name access control policy, aiming to solve the above problems. The present invention tests the effectiveness of the DGA identification method interception effect of existing network security equipment, combines and utilizes the DGA algorithm and scenario, and optimizes it to make the attack more concealed. After passing this test item, the gateway security product can achieve a very high level of protection, and the protection effect on the intranet is qualitatively improved.

[0010] The present invention is mainly achieved through the following technical solutions: A method for bypassing a domain name access control policy comprises the following steps: Step S1: Initially configure the domain name access control for the gateway device; Step S2: Encrypt the server IP that provides malware service communication to obtain encrypted contrl-server-ip information, and publish it on a well-known public server or cloud server; Step S3: Obtain the encrypted contrl-server-ip information from a well-known public server or cloud server through a test machine containing a malware program, and decrypt it to obtain the contrl-server-ip; Step S4: If the attack instruction is obtained from the control-server-ip, then go to step S5, the attack instruction includes encryption instruction and uploading stolen information; Step S5: Adjust the domain name security protection policy of the gateway device in step S1, and repeat steps S2 to S4 until the communication between the malware and the contrl-server-ip is blocked without affecting the communication between the malware host and the well-known public server or cloud server.

[0011] In order to better implement the present invention, further, in the step S2, the encrypted contrl-server-ip information is published in any one or more formats of files, texts, html, pictures, and compressed packages; the encrypted contrl-server-ip information carrier is published in posts and replies of well-known public servers irregularly or regularly, or the encrypted contrl-server-ip information is published in files, texts, html, pictures, and compressed packages of cloud servers.

[0012] In order to better implement the present invention, further, in step S2, the server IP address to be accessed by the malware is encrypted by the publisher using an agreed encryption method, and then published in any one or more posts or comments in Tieba, Weibo, CSDN, Taobao and Tmall.

[0013] In order to better implement the present invention, further, the method of encrypting the server IP is to directly convert the byte into a decimal number or convert it according to the network byte order, and then save these encrypted IPs in text form, or encrypt the compressed package again, or embed it at the end of the picture, so as not to affect the use and display of the picture and carry the ciphertext IP.

[0014] In order to better implement the present invention, further, in step S2, the server IP providing malware service communication is a public network IP2 or a controlled intranet host IP3; in step S5, the communication between malware and the public network IP2 or the intranet host IP3 is blocked.

[0015] In order to better implement the present invention, further, in step S3, an interface for periodically obtaining posts, replies, publishing product information, and evaluation information from well-known websites is written in the malware; or an interface for periodically obtaining files, pictures, and compressed package information from a cloud server is written in the malware.

[0016] In order to better implement the present invention, further, in the step S4, after decryption, a request is initiated to the corresponding server IP to obtain a rebound shell, instruction information or upload the stolen information.

[0017] In order to better implement the present invention, further, step S5 includes the following steps: Step S501: Preliminarily modify the domain name security protection strategy in step S1, and repeat steps S2 to S4. If the blocking protection effect cannot be achieved, proceed to step S502; Step S502: Block the attack by configuring the DGA malicious domain name identification method, and repeat steps S2 to S4. If the blocking protection effect is not good, proceed to step S503; Step S503: Adjust the linkage mode with the existing network to obtain online intelligence information in real time. When someone reports that the IP address of the detected malware service communication is a malicious IP address, block it through the malicious IP blacklist method.

[0018] A computer-readable storage medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the method according to any one of claims 1 to 8.

[0019] An electronic device comprises a memory and a processor; the memory stores a computer program; the processor is used to execute the computer program in the memory to implement the method according to any one of claims 1 to 8.

[0020] The beneficial effects of the present invention are as follows: After configuring the domain name security protection strategy, the present invention bypasses the gateway device to access the external network server through malware on the client side, thereby verifying the effectiveness of the gateway's control over the domain name. The present invention is to encrypt the server IP address to be accessed by the malware through an agreed encryption method by the publisher and publish it in the posts or comments of well-known general servers such as Tieba, Weibo, CSDN, Taobao, Tmall, etc. in various text or file forms. Then, the malware is used to obtain it weekly, and after decryption, a request is initiated to the corresponding IP to obtain a rebound shell, instruction information, or upload stolen information.

[0021] The present invention can solve the problem of firewalls and other gateway products identifying methods such as general DGA domain names, as well as the bypass mechanism of domain name protection filtering policies after threat intelligence information is collected, thereby achieving the function of detecting whether the gateway product's protection policy for malicious domain names is effective, enhancing the network protection level, and having good practicality. The present invention can solve the problem of complex use of firewalls and other gateway devices, and the difficulty of using them due to insufficient experience of network security administrators; it can form a visual protection for existing vulnerabilities in the network environment of security policies and protection; the present invention can realize safe, reliable, and intelligent detection of security policy configuration, and at the same time realize timely follow-up of detection plans and vulnerability announcements. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 A network topology diagram of the bypass test method of the domain name access control policy of the present invention; Figure 2 The present invention is a flowchart of a method for bypassing a domain name access control policy. DETAILED DESCRIPTION

[0023] Embodiment 1: A method for bypassing domain name access control policies, such as Figure 1 As shown, the present invention includes a test machine, an intranet switch and a gateway security device connected in sequence, and the gateway security device is connected to a well-known website, a cloud server VPS and a control server contrl-server through the Internet. Figure 2 As shown, the following steps are included: (1) Build a gateway device environment to be tested with domain name access control; (2) Configure the malicious domain name access control policy, i.e. the function to be tested; (3) Prepare well-known websites, such as Taobao, Tmall, Vipshop and other shopping websites, as well as Weibo, CSDN, Tianya, Baidu Tieba, blogs, etc. And / or prepare cloud server VPS, such as Tencent, Alibaba, Huawei, Telecom cloud server, etc.

[0024] (4) Periodically publish the encrypted control-server-ip information on the well-known website or cloud server VPS in step (3). The encrypted information can be stored in the form of files, text, pictures, compressed packages, etc., whichever is the same as that in the malware.

[0025] (5) Write an interface in the malware to periodically obtain posts, replies, product information, evaluation information, etc. from well-known websites. Or write an interface in the malware to periodically obtain files, pictures, and compressed package information from cloud servers.

[0026] (6) Write a function in the malware to decrypt the information obtained in step (5) and convert it into control-server-ip.

[0027] (7) Write a function in the malware to initiate a command request to the control-server-ip or upload stolen information.

[0028] (8) Adjust the domain name-related access control policy so that the malware PC can access the corresponding well-known website server normally, and can also access posts and reply messages normally. Or it can access the corresponding stores and evaluation information such as Taobao and Tmall. The ultimate goal is to be able to block the communication between the malware and the control-server-IP (with random variability) in a timely manner, but not affect the communication between the malware and well-known websites or cloud servers.

[0029] Preferably, the malicious domain name test specifically includes the following steps: ① Encrypt the IP address that provides malware service communication; ② Deliver the encrypted server IP in the format of file, text, html, picture, compressed package, etc.; ③ Publish the encrypted server IP in the format of files, text, html, pictures, compressed packages, etc. on well-known public servers and cloud servers.

[0030] Preferably, the above-mentioned method of encrypting IP is not limited. For example, the decimal number of 192.168.1.1 is 3232235777 after direct conversion according to bytes, and 16885952 after conversion according to network byte order. These two conversion methods are the simplest encryption methods.

[0031] Or 192.168.1.1 is encrypted with base64 to become MTkyLjE2OC4xLjE=, or even with a simple dictionary mapping: 1 represents 192, 2 represents 168, and 3 represents 1, then the encrypted string is 1.2.3.3.

[0032] These encrypted IPs are then saved in text form, or encrypted into compressed packages again, or embedded at the end of a picture, which means that the use and display of the picture will not be affected while carrying the ciphertext IP.

[0033] ④ Publish the encrypted server IP carrier in posts and replies on well-known public servers from time to time. Or publish the encrypted server IP in files, texts, HTML, pictures, and compressed packages on cloud servers.

[0034] ⑤ Write in the malware to obtain the corresponding encrypted server IP from the above-mentioned well-known public servers or rented cloud servers.

[0035] Preferably, the IP address that provides malware service communication can be a self-built public network IP2, or a controlled intranet host IP3. ⑥ Obtain attack instructions from the IP address that provides malware service communication, such as encrypting files in the system or passing collected information and files to it.

[0036] ⑦ Adjust the security policy of the gateway device to block the communication between the malware and the control server (ip2, ip3), but do not block the communication between the malware host and well-known public servers or rented cloud servers.

[0037] Preferably, after repeated modification of the strategy, if it is found that the ideal blocking protection effect cannot be achieved except directly adding the IP addresses mentioned in steps ① to ③ to the blacklist, then proceed to the next step.

[0038] By configuring the DGA malicious domain name identification method to block this attack method, most of the current DGA identification technologies use the principle of domain name random strings to intercept, but this attack scenario uses well-known domain names, such as taobao.com, which is not as random as khjiseff.com. If the interception effect of this function is not good, proceed to the next step.

[0039] By adjusting some linkage methods with the existing network, some online intelligence information is obtained in real time. After someone reports that the IP address mentioned in step ① to step ③ is a malicious IP address, it is successfully blocked through the malicious IP blacklist.

[0040] Preferably, if Figure 1 As shown, the well-known websites include Weibo, Tieba, Taobao, Tmall, JD.com, Tianya, csdn, etc. (referred to as server-ip1). The cloud server VPS can be a public cloud server rented from the public network, such as the cloud server VPS of cloud vendors such as Tencent, Alibaba, Huawei, Telecom, Amazon, Oracle, etc. (referred to as server-ip1). The control server is a cloud host actually used to control malware or communication, or a server with a public IP address of the attacker, referred to as contrl-server. The gateway security device can be configured with domain name access control policies. The intranet switch is optional depending on the networking scenario. The test machine has a malware program that can be encoded by itself After configuring the domain name security protection strategy, the present invention bypasses the gateway device on the client to access the external network server through malware, thereby verifying the effectiveness of the gateway's control over the domain name. The present invention is to encrypt the server IP address that the malware wants to access through an agreed encryption method by the publisher and publish it in the posts or comments of well-known general servers such as Tieba, Weibo, csdn, Taobao, Tmall, etc. in various text or file forms. Then, it is obtained weekly through malware, and after decryption, a request is initiated to the corresponding IP to obtain a rebound shell, instruction information, or upload stolen information, etc. The present invention can solve the problem of gateway products such as firewalls identifying methods such as general DGA domain names, and the bypass mechanism of domain name protection filtering strategies after threat intelligence information is collected, thereby achieving the effect of detecting whether the gateway product's protection strategy for malicious domain names is effective, enhancing the network protection level, and having good practicality.

[0041] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Any simple modification or equivalent change made to the above embodiment based on the technical essence of the present invention shall fall within the protection scope of the present invention.

Claims

1. A method for bypassing a domain name access control policy, characterized in that: The following steps are involved: Step S1: Initially configure the domain name access control for the gateway device; Step S2: Encrypt the server IP that provides malware service communication to obtain encrypted contrl-server-ip information, and publish it on a well-known public server or cloud server; Step S3: Obtain the encrypted contrl-server-ip information from a well-known public server or cloud server through a test machine containing a malware program, and decrypt it to obtain the contrl-server-ip; Step S4: If the attack instruction is obtained from the control-server-ip, then go to step S5, the attack instruction includes encryption instruction and uploading stolen information; Step S5: Adjust the domain name security protection policy of the gateway device in step S1, and repeat steps S2 to S4 until the communication between the malware and the contrl-server-ip is blocked without affecting the communication between the malware host and the well-known public server or cloud server.

2. A method for bypassing a domain name access control policy according to claim 1, characterized in that: In the step S2, the encrypted contrl-server-ip information is published in any one or more formats of files, texts, html, pictures, and compressed packages; the encrypted contrl-server-ip information carrier is published irregularly or regularly in posts and replies of well-known public servers, or the encrypted contrl-server-ip information is published in files, texts, html, pictures, and compressed packages of cloud servers.

3. A method for bypassing a domain name access control policy according to claim 2, characterized in that: In step S2, the publisher encrypts the server IP address that the malware wants to access using an agreed encryption method, and then publishes it in any one or more posts or comments on Tieba, Weibo, CSDN, Taobao and Tmall.

4. A method for bypassing a domain name access control policy according to claim 3, characterized in that: The method of encrypting the server IP is to directly convert the bytes into decimal numbers or convert them according to the network byte order, and then save these encrypted IPs in text form, or encrypt the compressed package again, or embed them at the end of the picture, so as not to affect the use and display of the picture and carry the ciphertext IP.

5. A method for bypassing a domain name access control policy according to claim 1, characterized in that: In the step S2, the server IP providing malware service communication is a public network IP2 or a controlled intranet host IP3; in the step S5, the communication between malware and the public network IP2 or the intranet host IP3 is blocked.

6. A method for bypassing a domain name access control policy according to claim 1, characterized in that: In step S3, an interface for periodically obtaining posts, replies, product information, and evaluation information from well-known websites is written in the malware; or an interface for periodically obtaining files, pictures, and compressed package information from a cloud server is written in the malware.

7. A method for bypassing a domain name access control policy according to claim 1, characterized in that: In step S4, after decryption, a request is initiated to the corresponding server IP to obtain a rebound shell, instruction information, or upload the stolen information.

8. A method for bypassing a domain name access control policy according to claim 1, characterized in that: The step S5 comprises the following steps: Step S501: Preliminarily modify the domain name security protection strategy in step S1, and repeat steps S2 to S4. If the blocking protection effect cannot be achieved, proceed to step S502; Step S502: Block the attack by configuring the DGA malicious domain name identification method, and repeat steps S2 to S4. If the blocking protection effect is not good, proceed to step S503; Step S503: Adjust the linkage mode with the existing network to obtain online intelligence information in real time. When someone reports that the IP address of the detected malware service communication is a malicious IP address, block it through the malicious IP blacklist method.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

10. An electronic device, characterized in that: The invention comprises a memory and a processor; the memory stores a computer program; the processor is used to execute the computer program in the memory to implement the method according to any one of claims 1 to 8.

Images