DNS hidden tunnel detection method, system and device based on eBPF

Abstract

The invention relates to the technical field of DNS hidden tunnel detection, and provides an eBPF-based DNS hidden tunnel detection method, system and device, and the method comprises the steps: capturing DNS traffic information in real time through deploying an eBPF program; performing risk judgment on the captured DNS traffic information through a predefined rule set; and performing response processing on the DNS traffic information of different risks according to a risk judgment result. According to the DNS hidden tunnel detection method, system and equipment based on the eBPF, limited detection resources can be better utilized, the detection efficiency of the hidden tunnel is improved, and waste of cloud computing resources is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of DNS covert tunnel detection, and in particular to an eBPF-based DNS covert tunnel detection method, system and device. Background Art

[0002] DNS covert tunnels bypass traditional firewalls and other network security devices by encapsulating malicious data in legitimate DNS protocol packets for transmission. DNS protocol is the most critical basic protocol of the Internet. Most firewalls and intrusion detection devices rarely filter DNS traffic, which provides conditions for DNS to be used as a covert tunnel, so that it can be used to achieve operations such as remote control and file transfer. DNS covert tunnels also often play an important role in botnets and APT attacks.

[0003] Traditional DNS covert tunnel detection methods mainly rely on the following technologies: 1. Signature-based detection: By maintaining a known covert tunnel signature database to detect matches in the traffic, however, due to the need to constantly update the signature library, this method is powerless against emerging covert tunnel attacks. 2. Traffic feature-based detection: By analyzing the traffic characteristics of DNS requests, such as request frequency, response time, request length, etc., to determine whether there is abnormal behavior, this method can detect covert tunnels to a certain extent, but it has limited effect on complex and disguised covert tunnels. 3. Machine learning-based detection: By training models to identify abnormal DNS requests, this method can effectively detect known and unknown covert tunnels, but it still faces challenges in the preparation of training data sets and the generalization ability of the model.

[0004] Although the above technology can detect DNS covert tunnels to a certain extent, there are still the following defects and shortcomings in practical applications: 1. Due to the reliance on central servers (i.e., cloud servers) for complex data processing, this centralized processing method is prone to performance bottlenecks in distributed large-scale network environments, especially when faced with massive DNS requests; 2. Due to the need to centrally process a large amount of log data, a large amount of computing resources are consumed, which not only increases the operating cost of the system, but also leads to increased latency and response time, and cannot meet the real-time requirements required by modern network security. When new threats emerge, it takes a while for the system to update the rules or models, resulting in potential security vulnerabilities; 3. There is a lack of flexibility in updating and expanding the rule set, especially when new covert tunnel features emerge, the rule base needs to be manually updated, which is time-consuming and error-prone.

[0005] Therefore, how to provide a DNS covert tunnel detection method with higher efficiency, higher real-time performance and less resource consumption has become a technical problem that needs to be solved urgently. Summary of the invention

[0006] In view of this, in order to overcome the deficiencies of the prior art, the present invention aims to provide a DNS covert tunnel detection method, system and device based on eBPF.

[0007] According to a first aspect of the present invention, there is provided a method, the method comprising: Capture DNS traffic information in real time by deploying eBPF programs; Risk assessment of captured DNS traffic information using predefined rule sets; Respond and process DNS traffic information with different risks based on the risk assessment results.

[0008] Preferably, in the DNS covert tunnel detection method based on eBPF of the present invention, DNS traffic information is captured in real time by deploying an eBPF program, including: deploying an eBPF program on an edge-side terminal device, monitoring system calls through the deployed eBPF program, and capturing DNS traffic information in real time, wherein the DNS traffic information includes DNS request information, DNS response information and process information.

[0009] Preferably, in the DNS covert tunnel detection method based on eBPF of the present invention, risk assessment is performed on the captured DNS traffic information through a predefined rule set, including: performing data feature matching on the DNS request data of the captured DNS traffic information according to the predefined rule set, and performing risk assessment on the captured DNS traffic information according to the matching results.

[0010] Preferably, in the eBPF-based DNS covert tunnel detection method of the present invention, data features of captured DNS traffic information are matched according to a predefined rule set, and risk determination is performed on the captured DNS traffic information according to the matching result, including: When the data characteristics of the DNS request data of the captured DNS traffic information completely match the predefined rule set, the DNS request of the captured DNS traffic information is determined to be a DNS covert tunnel request; When the data characteristics of the DNS request data of the captured DNS traffic information partially match the predefined rule set, the DNS request of the captured DNS traffic information is determined to be a suspected DNS covert tunnel request; When the data characteristics of the DNS request data of the captured DNS traffic information do not match the predefined rule set, the DNS request of the captured DNS traffic information is determined to be a non-DNS covert tunnel request.

[0011] Preferably, in the DNS covert tunnel detection method based on eBPF of the present invention, the data characteristics of the DNS traffic information include: domain name whitelist, DNS request frequency, DNS request length, DNS request type, domain name keywords, domain name randomness and domain name similarity.

[0012] Preferably, in the eBPF-based DNS covert tunnel detection method of the present invention, the predefined rule set includes rules for matching and detecting data features of DNS traffic information.

[0013] Preferably, in the eBPF-based DNS covert tunnel detection method of the present invention, the DNS traffic information of different risks is responded to and processed according to the risk determination result, including: When the DNS request of the captured DNS traffic information is a DNS covert tunnel request, an alarm and isolation response is issued to the corresponding DNS covert tunnel according to the DNS covert tunnel request; When the DNS request of the captured DNS traffic information is a suspected DNS covert tunnel request, the DNS request data corresponding to the suspected DNS covert tunnel request is transmitted to the cloud for analysis to detect unknown covert tunnel data characteristics.

[0014] Preferably, in the DNS covert tunnel detection method based on eBPF of the present invention, response processing is performed on DNS traffic information of different risks according to the risk determination result, and it also includes: converting the unknown covert tunnel data features obtained by cloud-side analysis and detection into data feature matching rules, and updating the predefined rule set by adding the data feature matching rules obtained by the conversion to the predefined rule set.

[0015] According to a second aspect of the present invention, there is provided a DNS covert tunnel detection system based on eBPF, the system comprising a detection server, the detection server being used to: capture DNS traffic information in real time by deploying an eBPF program; perform risk assessment on the captured DNS traffic information by using a predefined rule set; and perform response processing on DNS traffic information of different risks according to the risk assessment result.

[0016] According to a third aspect of the present invention, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in the first aspect of the present invention when executing the program.

[0017] The present invention is based on the eBPF DNS hidden tunnel detection method, system and device, uses Linux eBPF technology to collect DNS request and response related metadata and predefined rule matching analysis, and uses very few resources on the terminal to detect and filter DNS logs in real time, which greatly improves the detection efficiency, facilitates timely response to stop losses, and greatly reduces the amount of DNS logs, reducing the loss of cloud computing resources; at the same time, relying on cloud detection services, it can also discover unknown DNS hidden tunnel activities, and convert their characteristics into rules, supplement terminal detection rules to form a closed loop, and improve the flexibility of the detection system. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 This is an example diagram of the architecture of a DNS covert tunnel detection system based on eBPF according to an embodiment of the present invention; Figure 2 An example diagram of an architecture of a detection server of a DNS covert tunnel detection system based on eBPF according to the present invention; Figure 3 A flowchart of a DNS covert tunnel detection method based on eBPF according to an embodiment of the present invention; Figure 4 A schematic diagram of the structure of the device provided by the present invention. DETAILED DESCRIPTION

[0020] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0021] It should be noted that the following embodiments and features in the embodiments may be combined with each other in the absence of conflict; and, based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making any creative work are within the scope of protection of the present disclosure.

[0022] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein may be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present disclosure, it should be understood by those skilled in the art that an aspect described herein may be implemented independently of any other aspect, and two or more of these aspects may be combined in various ways. For example, any number of aspects described herein may be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein may be used to implement this device and / or practice this method.

[0023] The technical principles of the present invention are as follows: The cloud-side collaboration approach combines cloud-based detection services with edge-side terminal device detection services. By deploying lightweight eBPF programs on edge-side terminal devices to capture and analyze network traffic in real time, the massive DNS requests are quickly detected and filtered based on predefined rule sets to screen out confirmed or suspected DNS covert tunnel requests. The filtered DNS logs are then aggregated to the cloud for in-depth analysis to detect whether there are unknown covert tunnel activities, and converted into detection rules to supplement the rule set, supporting real-time detection on edge-side terminal devices.

[0024] Figure 1 FIG. 4 is an example diagram of the architecture of a DNS covert tunnel detection system based on eBPF according to an embodiment of the present invention. Figure 1 As shown, the system may include a detection server 101, a communication network 102 and / or one or more detection clients 103. Figure 1 The example shown is a plurality of detection clients 103 .

[0025] The detection server 101 can be any appropriate server for storing information, data, programs and / or any other suitable type of content. In some embodiments, the detection server 101 can perform appropriate functions. For example, in some embodiments, the detection server 101 can be used to detect DNS covert tunnels based on eBPF. As an optional example, in some embodiments, the detection server 101 can be used to: capture DNS traffic information in real time by deploying an eBPF program; perform risk determination on the captured DNS traffic information through a predefined rule set; and respond to DNS traffic information of different risks according to the risk determination results.

[0026] Figure 2 The following is an example of an architecture of a detection server of a DNS covert tunnel detection system based on eBPF according to the present invention, as shown in FIG. Figure 2 As shown, the detection service end of the present invention includes: Display layer: used to display detection rules, alarm information, security status and other information. It can display alarm information and security status information to security administrators or users through the Web interface, SMS, etc., so that they can understand the security status of the system in real time. It can also be used for users to configure or start and stop DNS covert tunnel detection rules.

[0027] Control layer: It consists of an alarm parser and a rule controller. The alarm parser is used to receive alarm information from the log service, and classify and process it according to the alarm level, alarm type, alarm source and other information. After parsing and aggregating the alarms, they are written to MySQL. The rule controller is used to dynamically update the configuration of the Agent on the terminal device to meet the changes in security policies.

[0028] Storage layer: used for data transmission and storage between different services, including kafka, mysql database and eBPF map. For example, the control layer uses kafka to receive the user-configured policies issued by the monitoring layer and sends them to the user-state agent; mysql is used to store persistent data, such as alarms, agent information, user configuration, etc.; eBPF map is used for data interaction between user-state agent and kernel-state agent.

[0029] Edge collection and detection layer: It includes two functions: user-state agent and eBPF program. The user-state agent is used to load the eBPF program, pass the detection rule set to the eBPF program, and receive DNS logs, alarm logs, etc. The eBPF program is used to collect DNS metadata and match the rule set to identify DNS covert tunnel activities.

[0030] Cloud detection layer: that is, cloud detection service, which is used to read DNS logs and perform in-depth analysis based on machine learning to detect unknown covert tunnel activities and convert covert tunnel features into new rules for edge detection engine detection.

[0031] As another example, in some embodiments, the detection server 101 may send the eBPF-based DNS covert tunnel detection method to the detection client 103 for user use based on the request of the detection client 103 .

[0032] As an optional example, in some embodiments, the detection client 103 is used to provide a visual detection interface, which is used to receive a user's selection input operation for detecting a DNS covert tunnel based on eBPF, and to, in response to the selection input operation, obtain a detection interface corresponding to the option selected by the selection input operation from the detection server 101 and display the detection interface, wherein the detection interface at least displays information on detecting a DNS covert tunnel based on eBPF and operation options for the information on detecting a DNS covert tunnel based on eBPF.

[0033] In some embodiments, the communication network 102 can be any suitable combination of one or more wired and / or wireless networks. For example, the communication network 102 can include any one or more of the following: the Internet, an intranet, a wide area network (WAN), a local area network (LAN), a wireless network, a digital subscriber line (DSL) network, a frame relay network, an asynchronous transfer mode (ATM) network, a virtual private network (VPN) and / or any other suitable communication network. The detection client 103 can be connected to the communication network 102 by one or more communication links (for example, communication link 104), and the communication network 102 can be linked to the detection service end 101 via one or more communication links (for example, communication link 105). The communication link can be any communication link suitable for transmitting data between the detection client 103 and the detection service end 101, such as a network link, a dial-up link, a wireless link, a hard-wired link, any other suitable communication link or any suitable combination of such links.

[0034] The detection client 103 may include any one or more clients that present an interface related to the detection of DNS covert tunnels based on eBPF in an appropriate form for use and operation by a user. In some embodiments, the detection client 103 may include any suitable type of device. For example, in some embodiments, the detection client 103 may include a mobile device, a tablet computer, a laptop computer, a desktop computer, and / or any other suitable type of client device.

[0035] Although the detection server 101 is illustrated as one device, in some embodiments, any appropriate number of devices may be used to perform the functions performed by the detection server 101. For example, in some embodiments, multiple devices may be used to implement the functions performed by the detection server 101. Alternatively, a cloud service may be used to implement the functions of the detection server 101.

[0036] Based on the above system, an embodiment of the present invention provides a DNS covert tunnel detection method based on eBPF, which is described below through the following embodiments.

[0037] Figure 3 1 is a flowchart of a method for detecting a DNS hidden tunnel based on eBPF according to an embodiment of the present invention. The method for detecting a DNS hidden tunnel based on eBPF in this embodiment can be executed on the detection server, such as Figure 3 As shown, the eBPF-based DNS hidden tunnel detection method includes the following steps: Step S201: Capture DNS traffic information in real time by deploying the eBPF program.

[0038] As an optional example, this embodiment deploys an eBPF program on an edge terminal device, monitors system calls through the deployed eBPF program, and captures DNS traffic information in real time. The DNS traffic information includes DNS request information, DNS response information, and process information. In this embodiment, eBPF (Extended BPF) is a program extension mechanism provided by the Linux kernel. It can run a custom C language program to monitor system calls, network events, access control, etc. without loading kernel modules. It has the advantages of high efficiency, security, flexibility, and low resource consumption. This embodiment uses eBPF technology to efficiently run the detection program in the kernel state. As a kernel extension tool, eBPF has good compatibility, no host operation overhead, and achieves a lighter deployment. It does not affect the performance and stability of the host system.

[0039] For example, the eBPF kprobe technology is used to monitor the sendto and recvfrom system calls to monitor and intercept DNS traffic information, such as the following DNS traffic related context information: DNS request information: source and destination IP addresses and port numbers, message, queried domain name and type, etc. DNS response information: status code, TTL value, record type (such as A record, CNAME record, etc.), etc.; Process information: process name, process PID, process command line, process file path, process working path, parent process name, parent process PID, parent process NSPID, parent process command line, parent process file path, parent process working path and other process related data.

[0040] Step S202: Perform risk assessment on the captured DNS traffic information using a predefined rule set.

[0041] This embodiment is based on the eBPF map mechanism and analyzes and filters the collected DNS request metadata through a predefined rule set, such as domain name whitelist, DNS request frequency, DNS request length, DNS request type, domain name keywords, domain name randomness, domain name similarity and other characteristics to complete the risk assessment of DNS requests.

[0042] As an optional example, this embodiment performs data feature matching on the DNS request data of the captured DNS traffic information according to the predefined rule set, and makes a risk determination on the captured DNS traffic information according to the matching result. As an optional example, when the data feature of the DNS request data of the captured DNS traffic information completely matches the predefined rule set, the DNS request of the captured DNS traffic information is determined to be a DNS covert tunnel request; when the data feature of the DNS request data of the captured DNS traffic information partially matches the predefined rule set, the DNS request of the captured DNS traffic information is determined to be a suspected DNS covert tunnel request; when the data feature of the DNS request data of the captured DNS traffic information does not match the predefined rule set, the DNS request of the captured DNS traffic information is determined to be a non-DNS covert tunnel request. In this embodiment, the data features of the DNS traffic information include: domain name whitelist, DNS request frequency, DNS request length, DNS request type, domain name keyword, domain name randomness, and domain name similarity. Real-time detection on the edge side ensures that suspicious activities can be captured quickly, improves detection efficiency, helps to quickly respond to and terminate the DNS covert tunnel, and ensures the security of terminal data. Detection and filtering on the edge can effectively reduce the operating costs of the overall system, save cloud computing resources, and flexibly configure detection rules as needed, which helps to integrate with existing security systems.

[0043] In this embodiment, the predefined rule set includes rules for matching and detecting data features of DNS traffic information. For example, the predefined rule set of this embodiment is as follows: Examples of predefined rule sets are as follows: a.cli starts with dns2tcpc and the record type is TXT, and the domain name has a segment =auth; b.cli contains dnscat, and the record type is CNAME. The length of the lowest-level domain name is greater than 30, and more than half of the domain name is digits. c. The record type is CNAME, MX or TXT, and the lowest-level domain name is dnscat; d. Three or more DNS record types such as TXT / CNAME / MX / A / AAAA are used, and some of them are longer than 50 characters; e. The query name is separated by periods, excluding the suffix, and has two or more segments with a length greater than 50; f. DNS request frequency: The number of different subdomains exceeds 20 within a statistical interval.

[0044] Step S203: respond to and process DNS traffic information of different risks according to the risk determination result.

[0045] As an optional example, in this embodiment, when the DNS request of the captured DNS traffic information is a DNS covert tunnel request, an alarm and isolation response is performed on the corresponding DNS covert tunnel according to the DNS covert tunnel request; when the DNS request of the captured DNS traffic information is a suspected DNS covert tunnel request, the DNS request data corresponding to the suspected DNS covert tunnel request is transmitted to the cloud for analysis to detect unknown covert tunnel data features. It should be noted that this embodiment converts the unknown covert tunnel data features obtained by cloud analysis and detection into data feature matching rules, and updates the predefined rule set by adding the data feature matching rules obtained by the conversion to the predefined rule set.

[0046] For example, this embodiment uses behavioral analysis, machine learning and other detection methods to conduct in-depth analysis of DNS request data corresponding to suspected DNS covert tunnel requests, detect unknown covert tunnel activities, and convert covert tunnel features into new rules for edge detection engine detection. The machine learning algorithm of the cloud detection service can effectively identify unknown covert tunnel activities, complete detection rules, and improve edge detection effects.

[0047] Compared with the prior art, in actual applications, the eBPF-based DNS covert tunnel detection method and system of this embodiment uses Linux eBPF technology to collect DNS request and response related metadata and predefined rule matching analysis, and uses very few resources on the terminal to perform real-time detection and filtering of DNS logs, which greatly improves the detection efficiency, facilitates timely response to stop losses, and greatly reduces the amount of DNS logs, reducing the loss of cloud computing resources; at the same time, relying on cloud detection services, it can also discover unknown DNS covert tunnel activities, and convert their characteristics into rules, supplement the terminal detection rules to form a closed loop, and improve the flexibility of the detection system.

[0048] like Figure 4 As shown, the present invention also provides a device, including a processor 310, a communication interface 320, a memory 330 for storing a computer program executable by the processor, and a communication bus 340. The processor 310, the communication interface 320, and the memory 330 communicate with each other through the communication bus 340. The processor 310 implements the above-mentioned eBPF-based DNS covert tunnel detection method by running the executable computer program.

[0049] Among them, the computer program in the memory 330 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0050] The system embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, i.e., they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected based on actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art may understand and implement it without creative effort.

[0051] Through the description of the above implementation modes, those skilled in the art can clearly understand that each implementation mode can be implemented by means of software plus a necessary general hardware platform, or of course by hardware. Based on such an understanding, the above technical solution can essentially or in other words be embodied in the form of a software product that contributes to the prior art. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or some parts of the embodiment.

[0052] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A DNS hidden tunnel detection method based on eBPF, characterized in that: The method comprises: Capture DNS traffic information in real time by deploying eBPF programs; Risk assessment of captured DNS traffic information using predefined rule sets; Respond and process DNS traffic information with different risks based on the risk assessment results.

2. The eBPF-based DNS covert tunnel detection method according to claim 1, characterized in that: DNS traffic information is captured in real time by deploying an eBPF program, including: deploying an eBPF program on an edge terminal device, monitoring system calls through the deployed eBPF program, and capturing DNS traffic information in real time, wherein the DNS traffic information includes DNS request information, DNS response information, and process information.

3. The eBPF-based DNS hidden tunnel detection method according to claim 1, characterized in that: The captured DNS traffic information is subjected to risk assessment through a predefined rule set, including: performing data feature matching on the DNS request data of the captured DNS traffic information according to the predefined rule set, and performing risk assessment on the captured DNS traffic information according to the matching result.

4. The eBPF-based DNS covert tunnel detection method according to claim 3, characterized in that: Match the data features of the captured DNS traffic information according to the predefined rule set, and make risk assessments on the captured DNS traffic information based on the matching results, including: When the data characteristics of the DNS request data of the captured DNS traffic information completely match the predefined rule set, the DNS request of the captured DNS traffic information is determined to be a DNS covert tunnel request; When the data characteristics of the DNS request data of the captured DNS traffic information partially match the predefined rule set, the DNS request of the captured DNS traffic information is determined to be a suspected DNS covert tunnel request; When the data characteristics of the DNS request data of the captured DNS traffic information do not match the predefined rule set, the DNS request of the captured DNS traffic information is determined to be a non-DNS covert tunnel request.

5. The eBPF-based DNS covert tunnel detection method according to claim 4, characterized in that: The data features of DNS traffic information include: domain name whitelist, DNS request frequency, DNS request length, DNS request type, domain name keywords, domain name randomness, and domain name similarity.

6. The eBPF-based DNS hidden tunnel detection method according to claim 5, characterized in that: The predefined rule set includes rules for matching and detecting data features of DNS traffic information.

7. The eBPF-based DNS covert tunnel detection method according to claim 1, characterized in that: Based on the risk assessment results, the DNS traffic information with different risks is responded to and processed, including: When the DNS request of the captured DNS traffic information is a DNS covert tunnel request, an alarm and isolation response is issued to the corresponding DNS covert tunnel according to the DNS covert tunnel request; When the DNS request of the captured DNS traffic information is a suspected DNS covert tunnel request, the DNS request data corresponding to the suspected DNS covert tunnel request is transmitted to the cloud for analysis to detect unknown covert tunnel data characteristics.

8. The eBPF-based DNS covert tunnel detection method according to claim 7, characterized in that: Responding to and processing DNS traffic information of different risks according to the risk determination results also includes: converting unknown hidden tunnel data features obtained by cloud-based analysis and detection into data feature matching rules, and updating the predefined rule set by adding the data feature matching rules obtained by the conversion to the predefined rule set.

9. A DNS hidden tunnel detection system based on eBPF, characterized in that: The system includes a detection server, which is used to: capture DNS traffic information in real time by deploying an eBPF program; perform risk assessment on the captured DNS traffic information by using a predefined rule set; and respond to and process DNS traffic information of different risks according to the risk assessment result.

10. A computer device, characterized in that: The computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, and the processor implements the steps of the method according to any one of claims 1 to 8 when executing the program.

Images