An eBPF-based DNS covert tunnel detection method, system and device

Abstract

The application relates to the technical field of DNS covert tunnel detection, and provides a DNS covert tunnel detection method and system and equipment based on eBPF, which comprises the following steps: capturing DNS traffic information in real time by deploying an eBPF program; performing risk judgment on the captured DNS traffic information by using a pre-defined rule set; and performing response processing on DNS traffic information with different risks according to the risk judgment result.The DNS covert tunnel detection method and system and equipment based on eBPF can better utilize limited detection resources, improve the detection efficiency of the covert tunnel, and reduce the waste of cloud computing resources.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of DNS covert tunnel detection, in particular to a DNS covert tunnel detection method and system based on eBPF and equipment. BACKGROUND

[0002] DNS covert tunnel transmits malicious data by encapsulating it in legitimate DNS protocol packets, thereby bypassing traditional firewalls and other network security devices. DNS protocol is the most critical foundation protocol of the Internet, and most firewalls and intrusion detection devices rarely filter DNS traffic, which provides conditions for DNS as a covert tunnel, so that it can be used to realize operations such as remote control, file transfer, etc. DNS covert tunnel often plays an important role in botnets and APT attacks.

[0003] Traditional DNS covert tunnel detection methods mainly rely on the following technologies: 1. Signature-based detection, which detects matching items in traffic by maintaining a known covert tunnel signature database. However, this method is powerless against newly emerging covert tunnel attacks, as the signature library needs to be constantly updated. 2. Detection based on traffic characteristics: by analyzing the traffic characteristics of DNS requests, such as request frequency, response time, request length, etc., to determine whether there is abnormal behavior. This method can detect covert tunnels to some extent, but its effectiveness is limited for complex and disguised covert tunnels. 3. Machine learning-based detection, which trains models to identify abnormal DNS requests. This method can effectively detect known and unknown covert tunnels, but still faces challenges in preparing training data sets and model generalization capabilities.

[0004] Although the above technologies can detect DNS covert tunnels to some extent, they still have the following defects and deficiencies in practical application: 1. Since it relies on a central server (i.e. cloud server) for complex data processing, this centralized processing method is prone to performance bottlenecks in distributed large-scale network environments, especially when faced with massive DNS requests; 2. Since it needs to process a large amount of log data centrally, it consumes a large amount of computing resources, which not only increases the system's operating costs, but also causes delays and response time increases, making it unable to meet the real-time requirements of modern network security. When new threats arise, the system needs some time to update the rules or models, thus causing potential security vulnerabilities; 3. Lack of flexibility in updating and expanding the rule set, especially when new covert tunnel features appear, the rule library needs to be updated manually, which is time-consuming and prone to errors.

[0005] Therefore, how to provide a DNS covert tunnel detection method with higher efficiency, higher real-time performance and less resource consumption has become a technical problem to be solved. SUMMARY

[0006] Therefore, in order to overcome the deficiencies of the prior art, the present application aims to provide an eBPF-based DNS covert tunnel detection method and system and device.

[0007] According to a first aspect of the present application, a method is provided, the method comprising:

[0008] real-time capture of DNS traffic information by deploying eBPF programs;

[0009] risk determination of the captured DNS traffic information by a predefined rule set;

[0010] response processing of DNS traffic information of different risks according to the risk determination results.

[0011] Preferably, in the eBPF-based DNS covert tunnel detection method of the present application, the real-time capture of DNS traffic information by deploying eBPF programs comprises: deploying eBPF programs on edge-side terminal devices, monitoring system calls through the deployed eBPF programs, and real-time capturing of DNS traffic information, wherein the DNS traffic information includes DNS request information, DNS response information and process information.

[0012] Preferably, in the eBPF-based DNS covert tunnel detection method of the present application, the risk determination of the captured DNS traffic information by a predefined rule set comprises: data feature matching of DNS request data of the captured DNS traffic information according to the predefined rule set, and risk determination of the captured DNS traffic information according to the matching results.

[0013] Preferably, in the eBPF-based DNS covert tunnel detection method of the present application, the data feature matching of the captured DNS traffic information according to the predefined rule set, and the risk determination of the captured DNS traffic information according to the matching results, comprise:

[0014] when the data features of the DNS request data of the captured DNS traffic information completely match the predefined rule set, determining the DNS request of the captured DNS traffic information as a DNS covert tunnel request;

[0015] when the data features of the DNS request data of the captured DNS traffic information partially match the predefined rule set, determining the DNS request of the captured DNS traffic information as a suspected DNS covert tunnel request;

[0016] when the data features of the DNS request data of the captured DNS traffic information do not match the predefined rule set, determining the DNS request of the captured DNS traffic information as a non-DNS covert tunnel request.

[0017] Preferably, in the DNS covert tunnel detection method based on eBPF of the present invention, the data characteristics of DNS traffic information include: domain name whitelist, DNS request frequency, DNS request length, DNS request type, domain name keywords, domain name randomness and domain name similarity.

[0018] Preferably, in the eBPF-based DNS covert tunnel detection method of the present invention, the predefined rule set includes rules for matching and detecting data features of DNS traffic information.

[0019] Preferably, in the eBPF-based DNS covert tunnel detection method of the present invention, response processing is performed on DNS traffic information of different risks according to the risk determination result, including:

[0020] When the DNS request of the captured DNS traffic information is a DNS covert tunnel request, an alarm and isolation response is issued for the corresponding DNS covert tunnel according to the DNS covert tunnel request;

[0021] When the DNS request of the captured DNS traffic information is a suspected DNS covert tunnel request, the DNS request data corresponding to the suspected DNS covert tunnel request is transmitted to the cloud for analysis to detect unknown covert tunnel data characteristics.

[0022] Preferably, in the DNS covert tunnel detection method based on eBPF of the present invention, response processing is performed on DNS traffic information of different risks according to the risk judgment result, and it also includes: converting the unknown covert tunnel data features obtained by cloud-side analysis and detection into data feature matching rules, and updating the predefined rule set by adding the data feature matching rules obtained by the conversion to the predefined rule set.

[0023] According to a second aspect of the present invention, a DNS covert tunnel detection system based on eBPF is provided, which includes a detection server, which is used to: capture DNS traffic information in real time by deploying an eBPF program; perform risk assessment on the captured DNS traffic information through a predefined rule set; and respond to and process DNS traffic information of different risks based on the risk assessment results.

[0024] According to a third aspect of the present invention, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in the first aspect of the present invention when executing the program.

[0025] The application is based on an eBPF-based DNS covert tunnel detection method and system and device, uses Linux eBPF technology to collect DNS request and response related metadata and pre-defined rule matching analysis, and uses very few resources on the terminal to detect and filter DNS logs in real time, greatly improves the detection efficiency, facilitates timely response to stop loss, and greatly reduces the DNS log amount and the loss of cloud computing resources; at the same time, relying on the cloud detection service can also discover unknown DNS covert tunnel activities, and convert their features into rules to make up for the terminal detection rules to form a closed loop and improve the flexibility of the detection system. BRIEF DESCRIPTION OF DRAWINGS

[0026] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the embodiments will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0027] Figure 1 An architecture example diagram of an eBPF-based DNS covert tunnel detection system according to an embodiment of the present application;

[0028] Figure 2 An architecture example diagram of a detection service end of an eBPF-based DNS covert tunnel detection system according to the present application;

[0029] Figure 3 A step flow chart of an eBPF-based DNS covert tunnel detection method according to an embodiment of the present application;

[0030] Figure 4 A structure schematic diagram of the device provided by the present application. DETAILED DESCRIPTION

[0031] The embodiments of the present application will be described in detail below with reference to the drawings.

[0032] It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict; and based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present disclosure.

[0033] It is important to note that the various aspects described herein are exemplary in nature and are not intended to limit the scope, applicability, or configuration of embodiments. Rather, the aspects described herein provide a description for the implementation of the described aspects. In this regard, some aspects described herein can be implemented independently of other aspects, and the disclosure can be implemented with only some of these aspects. Other implementations, uses, and advantages of the aspects disclosed herein will be apparent to one of ordinary skill in the art from the following detailed description when taken in conjunction with the accompanying drawings.

[0034] The technical principles of the present application are as follows:

[0035] The cloud detection service and edge terminal device detection service are combined, that is, the cloud-edge collaborative mode is used, the lightweight eBPF program is deployed on the edge terminal device to capture and analyze the network traffic in real time, the massive DNS request is quickly detected and filtered based on the pre-defined rule set, and the determined or suspected DNS stealth tunnel request is screened out; then the filtered and screened DNS log is summarized to the cloud for in-depth analysis to detect whether there is unknown stealth tunnel activity, and is converted into a detection rule to supplement the rule set, and supports real-time detection on the edge terminal device.

[0036] Figure 1 For an architecture example of an eBPF-based DNS stealth tunnel detection system according to an embodiment of the present application, as shown in Figure 1 The system can include a detection service end 101, a communication network 102, and / or one or more detection clients 103, Figure 1 For example, the detection clients 103 can be multiple detection clients.

[0037] The detection service end 101 can be any appropriate server for storing information, data, programs, and / or any other suitable type of content. In some embodiments, the detection service end 101 can perform appropriate functions. For example, in some embodiments, the detection service end 101 can be used for detecting DNS stealth tunnels based on eBPF. As an optional example, in some embodiments, the detection service end 101 can be used to: capture DNS traffic information in real time by deploying eBPF programs; make risk judgments on the captured DNS traffic information through a pre-defined rule set; and respond to different risk DNS traffic information according to the risk judgment result.

[0038] Figure 2 For an architecture example of a detection service end of an eBPF-based DNS stealth tunnel detection system according to the present application, as shown in Figure 2As shown, the detection service end of the present application includes:

[0039] The display layer: used for displaying detection rules, alarm information and security state information, etc. The alarm information and security state information can be displayed to the security administrator or user in the form of Web interface, short message, etc. to facilitate the real-time grasp of the security status of the system by the user. It can also be used for user configuration or start / stop of the DNS stealth tunnel detection rule.

[0040] The control layer: composed of an alarm parser and a rule controller. The alarm parser is used to receive alarm information from the log service and process it according to alarm level, alarm type, alarm source, etc. After parsing and aggregating the alarm, it is written into the mysql. The rule controller is used to dynamically configure and update the Agent on the terminal device to meet the change of the security policy.

[0041] The storage layer: used for data transmission and storage between different services, including kafka, mysql database and eBPF map. For example, the control layer uses kafka to receive the policy configured by the user and sent to the user-mode Agent. The mysql is used to store persistent data such as alarm, Agent information, user configuration, etc. The eBPF map is used for data interaction between the user-mode Agent and the kernel-mode Agent.

[0042] The edge collection and detection layer: including two functions of user-mode Agent and eBPF program. The user-mode Agent is used to load the eBPF program, deliver the detection rule set to the eBPF program, and receive DNS log, alarm log, etc. The eBPF program is used to collect DNS metadata and match the rule set to identify the DNS stealth tunnel activity.

[0043] The cloud detection layer: the cloud detection service, used to read the DNS log and perform deep analysis based on machine learning to detect unknown stealth tunnel activity, and convert the stealth tunnel features into new rules for edge detection engine detection.

[0044] As another example, in some embodiments, the detection service end 101 can send the eBPF-based DNS stealth tunnel detection method to the detection client 103 for user use according to the request of the detection client 103.

[0045] As an optional example, in some embodiments, the detection client 103 is configured to provide a visual detection interface configured to receive a selection input operation of the user for selecting eBPF-based detection of the DNS stealth tunnel, and configured to, in response to the selection input operation, obtain and display a detection interface corresponding to the option selected by the selection input operation from the detection server 101, the detection interface at least displaying information of the eBPF-based detection of the DNS stealth tunnel and operation options for the information of the eBPF-based detection of the DNS stealth tunnel.

[0046] In some embodiments, the communication network 102 can be any suitable combination of one or more wired and / or wireless networks. For example, the communication network 102 can include any one or more of the following: the Internet, an intranet, a wide-area network (WAN), a local-area network (LAN), a wireless network, a digital subscriber line (DSL) network, a frame relay network, an asynchronous transfer mode (ATM) network, a virtual private network (VPN), and / or any other suitable communication network. The detection client 103 can connect to the communication network 102 through one or more communication links (e.g., communication link 104), which can link to the detection server 101 via one or more communication links (e.g., communication link 105). The communication links can be any communication links suitable for communicating data among the detection client 103 and the detection server 101, such as network links, dial-up links, wireless links, hard-wired links, any other suitable communication links, or any suitable combination of such links.

[0047] The detection client 103 can include any one or more clients that present interfaces related to eBPF-based detection of the DNS stealth tunnel in a suitable form for use and operation by a user. In some embodiments, the detection client 103 can include any suitable type of device. For example, in some embodiments, the detection client 103 can include a mobile device, a tablet computer, a laptop computer, a desktop computer, and / or any other suitable type of client device.

[0048] Although the detection server 101 is illustrated as one device, in some embodiments, any suitable number of devices can be used to perform the functions performed by the detection server 101. For example, in some embodiments, multiple devices can be used to implement the functions performed by the detection server 101. Alternatively, the functions of the detection server 101 can be implemented using a cloud service.

[0049] Based on the above system, embodiments of the present application provide an eBPF-based DNS stealth tunnel detection method, which is described below through the following embodiments.

[0050] Figure 3 A step flowchart of an eBPF-based DNS covert tunnel detection method according to an embodiment of the present application. The eBPF-based DNS covert tunnel detection method of the present embodiment can be executed on a detection server, as shown in the figure. The eBPF-based DNS covert tunnel detection method includes the following steps: Figure 3

[0051] Step S201: Real-time capture of DNS traffic information through deployment of eBPF program.

[0052] As an optional example, the present embodiment deploys an eBPF program on an edge-side terminal device, monitors system calls through the deployed eBPF program, and real-time captures DNS traffic information, including DNS request information, DNS response information, and process information. In the present embodiment, eBPF (Extended BPF) is a program extension mechanism provided by the Linux kernel, which can run custom C language programs to monitor system calls, network events, and access control, etc., without loading kernel modules, and has the advantages of high efficiency, safety, flexibility, and low resource consumption. The present embodiment uses eBPF technology to efficiently run detection programs in kernel mode. As a kernel extension tool, eBPF has good compatibility, no host running overhead, and realizes lighter deployment. It does not affect the performance and stability of the host system.

[0053] For example, the eBPF kprobe technology is used to monitor the sendto and recvfrom system calls, which are used to monitor and intercept DNS traffic information, such as the following DNS traffic-related context information:

[0054] DNS request information: source and destination IP addresses and port numbers, messages, queried domain names, and types, etc.

[0055] DNS response information: status code, TTL value, record type (such as A record, CNAME record, etc.), etc.

[0056] Process information: process name, process PID, process command line, process file path, process working path, parent process name, parent process PID, parent process NSPID, parent process command line, parent process file path, parent process working path, and other process-related data.

[0057] Step S202: Risk determination of the captured DNS traffic information through a pre-defined rule set.

[0058] ​The embodiment is based on the eBPF map mechanism, and analyzes and filters the collected DNS request metadata through a predefined rule set, such as domain name whitelist, DNS request frequency, DNS request length, DNS request type, domain name keyword, domain name randomness, domain name similarity and the like, to complete the risk determination of the DNS request.

[0059] As an optional example, the embodiment performs data feature matching on the DNS request data of the captured DNS traffic information according to the predefined rule set, and performs risk determination on the captured DNS traffic information according to the matching result. As an optional example, when the data features of the DNS request data of the captured DNS traffic information completely match the predefined rule set, the DNS request of the captured DNS traffic information is determined as a DNS stealth tunnel request; when the data features of the DNS request data of the captured DNS traffic information partially match the predefined rule set, the DNS request of the captured DNS traffic information is determined as a suspected DNS stealth tunnel request; and when the data features of the DNS request data of the captured DNS traffic information do not match the predefined rule set, the DNS request of the captured DNS traffic information is determined as a non-DNS stealth tunnel request. In the embodiment, the data features of the DNS traffic information include domain name whitelist, DNS request frequency, DNS request length, DNS request type, domain name keyword, domain name randomness and domain name similarity. Real-time detection at the edge side ensures that suspicious activities can be quickly captured, improves detection efficiency, and helps to quickly respond to terminate the DNS stealth tunnel, thereby ensuring the security of terminal data. Detection and filtering at the edge side can effectively reduce the operation cost of the overall system, save cloud computing resources, and can flexibly configure detection rules according to needs, which is helpful for the combination with existing security systems.

[0060] In the embodiment, the predefined rule set includes rules for matching and detecting the data features of the DNS traffic information. For example, the predefined rule set of the embodiment is as follows:

[0061] The predefined rule set is as follows:

[0062] a. The cli starts with dns2tcpc and the record type is TXT, and the domain name has a segment = auth;

[0063] b. The cli contains dnscat, the record type is CNAME, the length of the last secondary domain name is greater than 30, and the number occupies more than half;

[0064] c. The record type is CNAME or MX or TXT, and the last secondary domain name is dnscat;

[0065] d. Three or more DNS record types are used among TXT / CNAME / MX / A / AAAA, and there are lengths greater than 50;

[0066] e. The Query Name is separated by a dot, the suffix is removed, and there are two or more segments with lengths greater than 50;

[0067] f. DNS request frequency: the number of different subdomains in a statistical interval is more than 20.

[0068] Step S203: According to the risk determination result, the DNS traffic information of different risks is processed.

[0069] As an optional example, in the present embodiment, when the DNS request of the captured DNS traffic information is a DNS covert tunnel request, the corresponding DNS covert tunnel is alarmed and isolated in response to the DNS covert tunnel request; when the DNS request of the captured DNS traffic information is a suspected DNS covert tunnel request, the DNS request data corresponding to the suspected DNS covert tunnel request is transmitted to the cloud for analysis, and unknown covert tunnel data characteristics are detected. It should be noted that the unknown covert tunnel data characteristics obtained by cloud analysis and detection are converted into data feature matching rules, and the data feature matching rules obtained by conversion are added to the predefined rule set to update the predefined rule set.

[0070] For example, the present embodiment uses behavior analysis, machine learning, and other detection methods to deeply analyze the DNS request data corresponding to the suspected DNS covert tunnel request, detects unknown covert tunnel activities, and converts the covert tunnel characteristics into new rules for edge detection engine detection. The machine learning algorithm of the cloud detection service can effectively identify unknown covert tunnel activities, complete the detection rules, and improve the edge detection effect.

[0071] Compared with the prior art, in actual application, the eBPF-based DNS covert tunnel detection method and system of the present embodiment uses Linux eBPF technology to collect DNS request and response related metadata and pre-defined rule matching analysis, and uses very little resources on the terminal to detect and filter DNS logs in real time, greatly improving the detection efficiency, facilitating timely response to loss, and greatly reducing the amount of DNS logs and the loss of cloud computing resources; At the same time, relying on the cloud detection service can also discover unknown DNS covert tunnel activities, and convert their characteristics into rules to supplement the terminal detection rules to form a closed loop and improve the flexibility of the detection system.

[0072] As Figure 4As shown, the application further provides a device including a processor 310, a communication interface 320, a memory 330 for storing a processor-executable computer program, and a communication bus 340. The processor 310, the communication interface 320, and the memory 330 complete communication with each other through the communication bus 340. The processor 310 realizes the above-mentioned eBPF-based DNS covert tunnel detection method by running the executable computer program.

[0073] The computer program in the memory 330 can be implemented in the form of a software functional unit and sold or used as an independent product, and can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0074] The system embodiments described above are only schematic, and the units illustrated as separate components can or can not be physically separated, and the components illustrated as units can or can not be physical units, i.e., they can be located in one place or distributed on multiple network units. Part or all of the modules can be selected based on actual needs to achieve the purpose of the present embodiment. Those skilled in the art can understand and implement without creative labor.

[0075] From the above description of the embodiments, those skilled in the art can clearly understand that the embodiments can be realized by means of software and the necessary general hardware platform, and of course, can also be realized by hardware. Based on this understanding, the above technical solutions essentially or the part that contributes to the prior art can be embodied in the form of a software product. The computer software product can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, etc., and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of the various embodiments or some parts of the embodiments.

[0076] The above merely illustrates the specific embodiments of the present application, but the protection scope of the present application is not limited thereto, any person skilled in the art can easily think of the changes or replacements within the technical range disclosed by the present application, which should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A DNS covert tunnel detection method based on eBPF, characterized in that: The method comprises: Capture DNS traffic information in real time by deploying eBPF programs; Risk assessment of captured DNS traffic information using predefined rule sets; Respond to and process DNS traffic information of different risks based on risk assessment results; Capturing DNS traffic information in real time by deploying an eBPF program, including: deploying an eBPF program on an edge terminal device, monitoring system calls through the deployed eBPF program, and capturing DNS traffic information in real time, wherein the DNS traffic information includes DNS request information, DNS response information, and process information; Performing risk assessment on the captured DNS traffic information using a predefined rule set, including: performing data feature matching on the DNS request data of the captured DNS traffic information according to the predefined rule set, and performing risk assessment on the captured DNS traffic information based on the matching results; Match the data features of captured DNS traffic information according to predefined rule sets, and make risk assessments based on the matching results, including: When the data characteristics of the DNS request data of the captured DNS traffic information completely match the predefined rule set, the DNS request of the captured DNS traffic information is determined to be a DNS covert tunnel request; When the data characteristics of the DNS request data of the captured DNS traffic information partially match the predefined rule set, the DNS request of the captured DNS traffic information is determined to be a suspected DNS covert tunnel request; When the data characteristics of the DNS request data of the captured DNS traffic information do not match the predefined rule set, the DNS request of the captured DNS traffic information is determined to be a non-DNS covert tunnel request; Based on the risk assessment results, DNS traffic information with different risks is responded to and processed, including: When the DNS request of the captured DNS traffic information is a DNS covert tunnel request, an alarm and isolation response is issued for the corresponding DNS covert tunnel according to the DNS covert tunnel request; When the DNS request of the captured DNS traffic information is a suspected DNS covert tunnel request, the DNS request data corresponding to the suspected DNS covert tunnel request is transmitted to the cloud for analysis to detect unknown covert tunnel data characteristics.

2. The eBPF-based DNS covert tunnel detection method according to claim 1, characterized in that: The data characteristics of DNS traffic information include: domain name whitelist, DNS request frequency, DNS request length, DNS request type, domain name keywords, domain name randomness, and domain name similarity.

3. The eBPF-based DNS covert tunnel detection method according to claim 2, characterized in that: The predefined rule set includes rules for matching and detecting data features of DNS traffic information.

4. The eBPF-based DNS covert tunnel detection method according to claim 1, characterized in that: Responding to and processing DNS traffic information of different risks based on the risk assessment results also includes: converting unknown covert tunnel data features obtained through cloud-based analysis and detection into data feature matching rules, and updating the predefined rule set by adding the converted data feature matching rules to the predefined rule set.

5. A DNS covert tunnel detection system based on eBPF, characterized in that: The system includes a detection server, which is used to: capture DNS traffic information in real time by deploying an eBPF program; and perform risk assessment on the captured DNS traffic information using a predefined rule set; Respond to and process DNS traffic information of different risks based on risk assessment results; DNS traffic information is captured in real time by deploying an eBPF program, including: deploying an eBPF program on an edge terminal device, monitoring system calls through the deployed eBPF program, and capturing DNS traffic information in real time, wherein the DNS traffic information includes DNS request information, DNS response information, and process information; performing risk assessment on the captured DNS traffic information using a predefined rule set, including: performing data feature matching on DNS request data of the captured DNS traffic information according to the predefined rule set, and performing risk assessment on the captured DNS traffic information based on the matching results; The data features of the captured DNS traffic information are matched according to a predefined rule set, and the risk assessment of the captured DNS traffic information is performed based on the matching results, including: when the data features of the DNS request data of the captured DNS traffic information completely match the predefined rule set, the DNS request of the captured DNS traffic information is assessed as a DNS covert tunnel request; when the data features of the DNS request data of the captured DNS traffic information partially match the predefined rule set, the DNS request of the captured DNS traffic information is assessed as a suspected DNS covert tunnel request; when the data features of the DNS request data of the captured DNS traffic information do not match the predefined rule set, the DNS request of the captured DNS traffic information is assessed as a non-DNS covert tunnel request; and the DNS traffic information of different risks is responded to and processed based on the risk assessment results, including: when the DNS request of the captured DNS traffic information is a DNS covert tunnel request, an alarm and isolation response are performed on the corresponding DNS covert tunnel according to the DNS covert tunnel request; when the DNS request of the captured DNS traffic information is a suspected DNS covert tunnel request, unknown covert tunnel data features are detected by transmitting the DNS request data corresponding to the suspected DNS covert tunnel request to the cloud for analysis.

6. A computer device, characterized in that: The computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the steps of the method according to any one of claims 1 to 4 are implemented.

Images