DNS authorization mechanism security threat assessment method and system based on domain name portrait

Abstract

The invention belongs to the technical field of information, and relates to a DNS authorization mechanism security threat assessment method and system based on a domain name portrait. The method comprises the following steps: acquiring original data of a domain name system and preprocessing the original data; constructing a domain name security portrait by using the preprocessed data of the domain name system; and performing authorization security threat assessment based on the domain name security portrait, including constructing a vulnerability analysis global view and performing threat monitoring. The system comprises a data preprocessing module, a domain name security portrait construction module and an authorization security threat evaluation module. The DNS authorization mechanism security threat assessment method based on the domain name portrait realizes DNS authorization mechanism security threat assessment based on the domain name portrait, provides a treatment and guarantee system capable of being actually deployed on the technical level for security risks caused by DNS authorization dependence, and can provide systematic and systematic solutions and guarantees for DNS authorization security.

Description

Technical Field

[0001] The present invention belongs to the field of information technology, and specifically relates to a method and system for assessing security threats of a DNS authorization mechanism based on domain name profiling. Background Art

[0002] The namespace structure, name allocation and resolution process of the current Domain Name System (DNS) all follow a strict hierarchical structure, and through "delegation" the management responsibility of the subdomain is delegated to another organization to ensure DNS scalability and disperse resolution pressure, and to achieve diversified name services in complex scenarios. However, the current authorization relationship is a "multi-mode, multi-hop, multi-path" structure, which makes the global DNS resolution logic increasingly complex, the authorization of important domain names relies on a lengthy trust chain, and is easily hijacked and manipulated by attackers.

[0003] In response to the above issues, many research works have been carried out at home and abroad, such as testing and verifying the security risks caused by specific authorization scenarios and DNS configurations, proposing innovative DNS service models and data management mechanisms from a secure and reliable perspective, etc. However, the existing work lacks systematic and systemic research on DNS authorization risks; nor has it proposed a governance and assurance system that can be actually deployed at the technical level for the security risks brought about by DNS authorization reliance. Summary of the invention

[0004] The present invention designs a DNS authorization mechanism security threat assessment method and system based on domain name portrait, providing a systematic and organized solution and guarantee for DNS authorization security.

[0005] The technical solution adopted by the present invention is as follows:

[0006] A method for assessing security threats of a DNS authorization mechanism based on domain name profiling includes the following steps:

[0007] Obtain the raw data of the domain name system and pre-process it;

[0008] Use the pre-processed domain name system data to build a domain name security portrait;

[0009] Perform authorization security threat assessment based on domain name security portraits, including building a global view of vulnerability analysis and conducting threat monitoring.

[0010] Furthermore, the original data of the domain name system includes: zone file data, domain name registration information database, recursive resolver, authoritative domain name server information and configuration data set, national domain name service resolution log, and national domain name security monitoring platform data; the preprocessing includes extracting, cleaning, integrating, and converting the collected domain name data, segmenting, splitting, and formatting and encoding the data, and then designing the database table structure and fields for the data, and connecting the preprocessed data to the corresponding real-time and batch processing big data processing platforms according to real-time and offline analysis attributes.

[0011] Furthermore, the construction of a domain name security portrait includes:

[0012] The characteristic labels of domain name security portraits are constructed by combining static data and dynamic detection, including basic attribute labels, dynamic detection labels, and message flow characteristic labels;

[0013] Based on the characteristic tags of the domain name security portrait, we build single-step authorization portrait, single authorization path portrait, domain name portrait and massive domain name portrait.

[0014] Furthermore, the steps of constructing the single-step authorization portrait include:

[0015] (1) For a specific domain name, obtain its authorization resource record type based on the authorization attribute information and generate an authorization record tag for single-step authorization;

[0016] (2) Detect whether the authorization record is authenticated or signed, and generate an authorization security tag;

[0017] (3) Detecting the authorization type as cross-top-level domain, cross-second-level domain, or local domain authorization, and generating an authorization type label;

[0018] (4) Verify the basic setting compliance of the authorization resource record type obtained in step (1);

[0019] (5) After steps (1) to (4) are completed, perform data consistency assessment;

[0020] (6) Conduct compliance assessment of server settings.

[0021] Furthermore, the steps of constructing the domain name portrait include:

[0022] (1) For each single-step authorization involved in domain name resolution, build it in sequence according to the steps of building a single-step authorization portrait;

[0023] (2) Associating each single-step authorization with each other to generate a domain name authorization relationship network;

[0024] (3) Generate domain name attribute tags, query domain name registration information through RDAP and Whios protocols, and extract validity period, registrant, registrar, and registration location information;

[0025] (4) For domestic domain names, query the ICP domain name registration information, determine the industry and purpose of the domain name based on the registration information and suffix information to identify the domain name category;

[0026] (5) Calculate the authorization record label and authorization type label of the domain name based on the single-step authorization profile of each hop;

[0027] (6) Generate a domain name authorization record security label based on the single-step authorization profile of each hop;

[0028] (7) Generate domain name authorization record based on the single-step authorization profile of each hop and set compliance labels;

[0029] (8) Generate a set of labels related to the consistency of domain name authorization record data based on the single-step authorization profile of each hop;

[0030] (9) Generate a set of labels related to the rationality of domain name server settings based on the single-step authorization profile of each hop;

[0031] (10) Select multiple recursive resolver vendors and versions;

[0032] (11) Detect whether the cache replaces the NS record of the existing parent domain with the NS record in the authoritative response received later;

[0033] (12) Detect whether the cache replaces the additional segment record of the existing parent domain with the additional segment record in the authoritative response received later;

[0034] (13) Generate a cache update mechanism tag according to steps (11) and (12), and set its value;

[0035] (14) Use topological sorting to detect whether there is a circular dependency;

[0036] (15) Perform path discovery, using the A* algorithm to detect the number of domain name resolution paths and the authorized topological relationship of each path, the path length, and the dependency set of each path;

[0037] (16) Calculate the minimum dependency set and key dependency nodes of domain name resolution based on the result of step (11), wherein the minimum dependency set is the minimum dependency set required for successful domain name resolution, and the key dependency node is the node that all resolution paths of the domain name need to rely on;

[0038] (17) The initial weight is set according to the urgency of the label impact, from high to low: causing the domain name to be unable to be resolved, unable to resolve the correct result, and inconsistent resolution results from multiple requests; the domain name can be resolved correctly but has an impact on the resolution performance; the above impacts have not been found so far but it does not meet the configuration specifications and there are potential unsafe vulnerabilities that can be exploited by attackers.

[0039] Furthermore, the steps of constructing the massive domain name portrait include:

[0040] (1) Develop core indicators based on the research scope;

[0041] (2) Construct a domain name profile for the domain name set within the research scope;

[0042] (3) Integrate the results of step (2), count the key dependency node features, calculate the dependency concentration, the company to which the node belongs, count the cross-top-level domain authorization dependency information during the authorization process, and build a massive domain name authorization portrait from the dimensions of dependency concentration, cross-border analysis, and cross-top-level domain dependency.

[0043] Furthermore, the construction of a global view of vulnerability analysis includes:

[0044] (1) According to the research object and objectives, select and build domain name authorization security portraits based on different dimensions such as single step, single path, single domain name, and massive domain names;

[0045] (2) Based on the result of step (1), authorization vulnerability analysis is performed according to different dimensions to obtain a global view of vulnerability analysis; the different dimensions include key dependency nodes, shortest paths, key dependency sets, authorization non-compliance items, data consistency, rationality of redundant settings, and dependency concentration;

[0046] (3) The global view of vulnerability analysis is provided to users through web page visualization and data reports, so that relevant parties can intuitively understand the authorization security risks of related domain names.

[0047] Furthermore, the threat monitoring includes:

[0048] (1) Construct a training dataset. The training dataset consists of two parts: one is the domain name set in the original data that is threatened by authorized security-related attacks, and the other is the domain name set that is not threatened by attacks;

[0049] (2) Classify authorized security-related attack threats and label the training set according to whether it has been attacked and the attack category;

[0050] (3) Construct security profiles for domain names in the training dataset;

[0051] (4) Building a classification model based on the domain name portrait, using the classification model to determine the conditions that need to be met for different types of attacks to occur, and assessing the threat risks faced by the domain name to be tested; the classification model uses a classification algorithm to perform multi-label classification learning on the training data set, and distinguishes normal domain names from domain names that have been attacked by specific attacks through classification training;

[0052] (5) Based on the classification model constructed in step (4), the attack risk faced by the domain name to be tested is evaluated and threat assessment and warning are performed.

[0053] A DNS authorization mechanism security threat assessment system based on domain name profiling, comprising:

[0054] A data preprocessing module is used to obtain the original data of the domain name system and preprocess it;

[0055] A domain name security profile building module is used to build a domain name security profile using pre-processed domain name system data;

[0056] The authorization security threat assessment module is used to perform authorization security threat assessment based on domain name security portraits, including building a global view of vulnerability analysis and conducting threat monitoring.

[0057] The beneficial effects of the present invention are as follows:

[0058] The present invention conducts a systematic and structured study on DNS authorization risks, realizes the security threat assessment of DNS authorization mechanism based on domain name portrait, and proposes a practically deployable governance and protection system at the technical level for the security risks brought by DNS authorization dependence, which can provide a systematic and structured solution and protection for DNS authorization security.

[0059] Compared with existing methods, this method comprehensively characterizes the security of domain name authorization based on feature model construction, which makes up for the shortcomings of existing methods and can more accurately and effectively conduct domain name authorization security monitoring and threat assessment. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 It is a flowchart of the steps of a method for security threat assessment of a DNS authorization mechanism based on domain name profiling according to an embodiment of the present invention.

[0061] Figure 2 The present invention is a schematic diagram of the module composition of a DNS authorization mechanism security threat assessment based on domain name profiling according to an embodiment of the present invention. DETAILED DESCRIPTION

[0062] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below through specific embodiments and drawings.

[0063] The present invention provides a DNS authorization mechanism security threat assessment method and system based on domain name portrait. The method is divided into a data preprocessing step, a domain name security portrait construction step, and an authorization security threat assessment step, which correspond to the data preprocessing module, the domain name security portrait construction module, and the authorization security threat assessment module of the system respectively. Among them, the authorization security threat assessment model construction module includes two parts: vulnerability analysis global view and threat monitoring.

[0064] Figure 1 This is a step flow of a DNS authorization mechanism security threat assessment method based on domain name portrait provided by an embodiment of the present invention, including: obtaining the original data of the domain name system and preprocessing it; using the preprocessed domain name system data to build a domain name security portrait; based on the domain name security portrait, performing authorization security threat assessment, including building a global view of vulnerability analysis and performing threat monitoring. The following is a detailed description of each step of the method.

[0065] Step 1: Data Preprocessing

[0066] (1) Develop data access interfaces to access domain name system raw data and integrate multi-source heterogeneous data.

[0067] The original data includes the following parts:

[0068] Zone file data, mainly involving resource records including NS, CNAME, DS, MX, ANAME, A, AAAA, DNAME, etc.;

[0069] Domain name registration information database;

[0070] Recursive resolver, authoritative domain name server information and configuration data set;

[0071] National domain name service resolution log;

[0072] National domain name security monitoring platform data.

[0073] (2) Extract, clean, integrate, convert and process the collected domain name data. Segment and link zone files, DNS response messages, logs and other data, as well as process the format and encoding.

[0074] (3) Carry out structured design on the above data, design the database table structure and fields, and design the storage and access structure of multi-source heterogeneous data from the dimensions of domain name attributes, registration information, authorization information, parsing logs, monitoring information, service configuration, etc.

[0075] (4) Connect the preprocessed data to the corresponding real-time and batch processing big data processing platforms, such as Spark Streaming, according to the real-time and offline analysis attributes.

[0076] Step 2: Build a domain security profile

[0077] This step is based on the business processes of domain name registration, resolution, data management, etc., and uses big data statistical analysis technology to build a multi-dimensional and hierarchical feature label framework for domain name security portraits. The present invention refers to the labeled domain name security model abstracted from multi-dimensional information such as domain name attributes, registration and resolution services, dependencies, authorization features, etc. as a "portrait".

[0078] Step 2.1: Build a feature label framework for domain name security portraits by combining static data and dynamic detection. Labels are divided into basic attribute labels, dynamic detection labels, and message flow feature labels.

[0079] (1) Basic attribute labels include different dimensions such as authorization attributes, authoritative service node attributes, recursive service node attributes, cache attributes, etc. Basic attribute labels are formulated according to the key information sets of different dimensions.

[0080] Authorization attributes include: authorized resource records, authorization type (local zone authorization, hierarchical cross-zone authorization, etc.), number of authoritative servers, authoritative server name, authoritative server IPv4 / IPv6 address, data source (parent zone, child zone), presence or absence of glue record, TTL, etc.

[0081] Authoritative service node attributes include: server IPv4 / IPv6 address, service provider, software version, supported security enhancement protocols and mechanisms, whether the corresponding domain name is expired, deployment configuration information, etc.

[0082] Recursive service node attributes include: service provider, software version, supported security enhancement protocols and mechanisms, deployment configuration information, etc.

[0083] Cache attributes include: manufacturer, version, data update mechanism, TTL setting, etc.

[0084] (2) Building dynamic detection tags

[0085] Some information cannot be obtained from static data and needs to be obtained through dynamic detection and then labeled.

[0086] For authoritative domain name servers, the information that needs to be obtained through dynamic detection includes: whether it is reachable, whether it can provide a response, the authoritative response result, whether the AA flag is set in the authoritative response, IP address detection, etc.

[0087] For zone files, the information that needs to be obtained through dynamic detection includes: whether the authorization records and address information in the zone files are consistent with the responses obtained through actual analysis, etc.

[0088] (3) Message traffic feature tags

[0089] Feature tags are extracted from message traffic data, including statistical features such as response performance, message size, number of query requests, and abnormal message classification.

[0090] Tag definition: including tag ID, tag name, tag value, update frequency, tag weight, and tag remarks.

[0091] Step 2.2: Single-step authorization profile construction

[0092] (1) Single-step authorization refers to specifying the resolution dependency of a domain name on other domain names or servers based on different types of authorization records. For a specific domain name, its authorization resource record type is obtained based on the authorization attribute information, and an authorization record tag is generated for the single-step authorization. For example, when the authorization record tag is NS, CNAME, or MX, the tag value can be 0, 1, 2, etc.

[0093] (2) Detect whether the authorization record is authenticated or signed, and generate an authorization security tag. The values ​​of ordinary plain text transmission and authenticated or signed authorization records are 0 and 1 respectively.

[0094] (3) Detect whether the authorization type is cross-top-level domain, cross-second-level domain, or local domain authorization, and generate an authorization type label.

[0095] (4) Verify the basic setting compliance of the resource record type obtained in step (1). Verify whether a CNAME record exists after specifying the NS and MX records; verify whether the TTL value setting and the naming standardization of the name server comply with the specification; generate a basic compliance label with values ​​of 0 and 1.

[0096] (5) After completing the above steps, evaluate data consistency:

[0097] (5.1) If authorized by NS, obtain the NS record and glue record in the parent zone and child zone respectively;

[0098] (5.2) Verify the relationship between the parent zone NS record set and the child zone: consistent, parent contains child, child contains parent, partially intersecting, or non-intersecting; generate NS consistency labels, with values ​​ranging from 0 to 4 according to the above relationship types;

[0099] (5.3) Check whether the corresponding glue records in the same NS records of the parent zone and the child zone are consistent, and generate glue consistency labels with values ​​of 0 and 1 respectively;

[0100] (5.4) Actively query the corresponding IP address for the NS record value, compare it with the content in the glue record to see if it is consistent, and generate a glue record reliability label with values ​​of 0 and 1 respectively;

[0101] (5.5) When the authorization type is intra-domain authorization, check whether there are any missing glue records. If necessary glue records are missing, generate a glue record missing tag.

[0102] (6) Server settings compliance assessment:

[0103] (6.1) Check the server number setting. If only one server is set, it does not comply with the regulations. Generate a server redundancy number compliance label with values ​​of 0 and 1 respectively.

[0104] (6.2) Verify whether the IP address pointed to by the glue record is a legal public address and generate an IP address validity label;

[0105] (6.2) Verify the rationality and validity of multiple server settings, obtain the IP addresses of the above multiple servers respectively, verify whether the multiple servers point to the same IP address, as well as the geographical location and network distribution of the multiple servers, whether they are located in the same location or network, whether anycast mechanism is set, and generate redundant validity tags;

[0106] (6.3) Detecting whether there is partial unavailability: Making connection requests to the above multiple servers respectively to check whether there is a phenomenon that some servers are unavailable; if any server is unavailable, generating a partial unavailable tag;

[0107] (6.4) Query the server domain name registration information, check whether it is expired, perform a connection test, check whether it is connected normally and returns a correct response, whether the AA flag field is set in the response, and generate a server availability tag;

[0108] (6.5) The query server location is domestic or overseas information, and a cross-border label for domain name resolution is generated.

[0109] Step 2.3: Authorization path profile construction

[0110] The authorization path refers to the complete path from the root zone to the final resolved domain name address. The path length is the number of hops through which the domain name is resolved through the path. Parent-child dependency or authorization defined by authorization records is one hop. As a submodule of domain name portrait, the authorization path portrait is integrated into the domain name portrait module, that is, step 2.3 is a path, and the following step 2.4 is a domain name portrait composed of multiple paths.

[0111] Step 2.4: Domain name profile construction

[0112] (1) For each single-step authorization involved in domain name resolution, build them in sequence according to the single-step authorization portrait steps;

[0113] (2) Associating each single-step authorization with each other to generate a domain name authorization relationship network;

[0114] (3) Generate domain name attribute tags, query domain name registration information through RDAP and Whios protocols, and extract information such as validity period, registrant, registrar, and registration location;

[0115] (4) For domestic domain names, query the ICP domain name registration information, and determine the industry, purpose, and other identification of the domain name category based on the registration information and suffix information, such as government domain names;

[0116] (5) Calculate the authorization record label and authorization type label of the domain name based on the single-step authorization profile of each hop ((1) and (3) in step 2.2);

[0117] (6) Generate a domain name authorization record security label based on the single-step authorization profile of each hop ((2) in step 2.2);

[0118] (7) Generate a domain name authorization record based on the single-step authorization profile of each hop (step 2.2 (4)) and set a compliance label. The label note is set to the specific non-compliance items. If multiple steps are non-compliant, a label set can be generated;

[0119] (8) Generate a set of labels related to the consistency of the domain name authorization record data based on the single-step authorization profile of each hop ((5) in step 2.2);

[0120] (9) Generate a set of labels related to the rationality of the domain name server settings based on the single-step authorization profile of each hop (step 2.2 (6));

[0121] (10) Select multiple recursive resolver vendors and versions;

[0122] (11) Detect whether the cache replaces the NS record of the existing parent domain with the NS record in the authoritative response received later;

[0123] (12) Detect whether the cache replaces the additional segment record of the existing parent domain with the additional segment record in the authoritative response received later;

[0124] (13) Generate a cache update mechanism tag according to steps (11) and (12), and set its value;

[0125] (14) Use topological sorting to detect whether there is a circular dependency;

[0126] (15) Perform path discovery, using the A* algorithm to detect the number of domain name resolution paths, the authorization topology relationship of each path, the path length, and the dependency set of each path;

[0127] (16) Calculate the minimum dependency set and key dependency nodes of domain name resolution based on the result of step (11), wherein the minimum dependency set is the minimum dependency set required for successful domain name resolution, and the key dependency node is the node that all resolution paths of the domain name need to rely on;

[0128] (17) The initial weight is set according to the urgency of the label impact, from high to low: causing the domain name to be unable to be resolved, unable to resolve the correct result, inconsistent resolution results of multiple requests; the domain name can be resolved correctly but affects the resolution performance; the above impacts have not been found but do not meet the configuration specifications, and there are potential unsafe vulnerabilities that can be exploited by attackers. The node weight for a specific domain name is determined by whether the node belongs to the key dependency set.

[0129] Among them, steps (5)-(9) and (14)-(15) can also be used as the implementation steps in step 2.3. The objects of these steps in step 2.4 are the entire domain name, while those in step 2.3 are only for a single path.

[0130] Step 2.5: Massive domain name portrait construction

[0131] Due to the huge number of domain names in the world, the security requirements of domain names in different countries or for different purposes are also inconsistent. When conducting massive domain name authorization analysis, a certain range of domain name objects is usually selected, and a specific set of domain names is expanded, such as domain names under a certain top-level domain, or domain names for specific industries or purposes, such as government domain names in a certain region or a specific country. The steps to build a massive domain name portrait include:

[0132] (1) Develop core indicators based on the research scope. For example, the research scope may be the national government domain name security assessment, the domain name security assessment under the national top-level domain, etc.;

[0133] (2) Build a security profile for the domain name set within the research scope according to step 2.4;

[0134] (3) Integrate the results of step (2), count the key dependency node features, calculate the dependency concentration, and the company to which the node belongs. Count the cross-top-level domain authorization dependency and other information during the authorization process. A massive domain name authorization portrait can be constructed from the dimensions of dependency concentration, whether the resolution is cross-border, and cross-top-level domain dependency. Dependency concentration means that the resolution of many domain names depends on specific key nodes.

[0135] Step 3: Perform authorization security threat assessment based on domain name profile

[0136] Authorized security threat assessment is divided into two modules: vulnerability analysis global view building module and threat monitoring module.

[0137] The process of building a vulnerability analysis global view module is as follows:

[0138] (1) According to the research object and objectives, we select and build domain name authorization security portraits based on different dimensions such as single step, single path, single domain name, and massive domain names.

[0139] (2) Based on the results of step (1), authorization vulnerability analysis is performed according to different dimensions such as key dependency nodes, shortest paths, key dependency sets, authorization non-compliance items, data consistency, rationality of redundant settings, and dependency concentration to obtain a global view of vulnerability analysis.

[0140] Among them, the key dependent nodes are the nodes that all resolution paths of the domain name need to rely on; the shortest path refers to the path with the shortest number of authorized hops for domain name resolution; the key dependent set refers to the set composed of key dependent nodes; authorization non-compliance items refer to non-standard labels in the authorization resource record configuration and other aspects found during the portrait construction process; data consistency refers to the inconsistency of authorization data found during the portrait construction process; the rationality of redundant settings refers to the problems found during the portrait construction process in the number of servers, geographical location, anycast mechanism deployment and other aspects; dependency concentration refers to the fact that many domain name resolutions found during the portrait construction process rely on a few nodes.

[0141] (3) The global view of vulnerability analysis is provided to users through web page visualization and data reports, so that domain name system administrators and other relevant parties can intuitively understand the authorization security risks of related domain names.

[0142] Threat monitoring module process:

[0143] (1) Construct a training dataset. The training dataset consists of two parts: one is the set of domain names in the original data that are threatened by authorized security-related attacks, and the other is the set of domain names that are not threatened by attacks.

[0144] (2) Classify authorized security-related attack threats and label the training set according to whether it has been attacked and the attack category.

[0145] (3) For the domain names in the above training data set, construct a security profile according to the above process.

[0146] (4) Build a classification model based on the domain name portrait, use the classification model to determine the conditions that need to be met for different types of attacks to occur, and evaluate the threat risks faced by the domain name to be tested. The classification model uses a classification algorithm to perform multi-label classification learning on the training data set, and distinguishes normal domain names from domain names that have been attacked by specific attacks through classification training. This process can use a method based on domain name portrait training graph neural network for classification, and build a verification data set to cross-validate and optimize the classification model.

[0147] (5) Based on the classification model constructed in step (4), the attack risk faced by the domain name to be tested is evaluated and threat assessment and warning are performed.

[0148] Another embodiment of the present invention provides a DNS authorization mechanism security threat assessment system based on domain name portraits, such as Figure 2 As shown, the device comprises:

[0149] A data preprocessing module is used to obtain the original data of the domain name system and preprocess it;

[0150] A domain name security profile building module is used to build a domain name security profile using pre-processed domain name system data;

[0151] The authorization security threat assessment module is used to perform authorization security threat assessment based on domain name security portraits, including building a global view of vulnerability analysis and conducting threat monitoring.

[0152] The specific implementation process of each module refers to the above description of the method of the present invention.

[0153] In the above embodiments provided by the present invention, it should be understood that the disclosed methods and systems can be implemented in other ways. For example, the system embodiments described above are only schematic, and the division of the modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the parameters mentioned in the above embodiments can be replaced with other parameters within a reasonable range according to actual applications.

[0154] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform some steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program codes.

[0155] For example, one embodiment of the present invention provides a computer device, which includes a memory and a processor, wherein the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program includes instructions for executing each step in the method of the present invention.

[0156] For example, one embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a computer, the steps of the method of the present invention are implemented.

[0157] The specific embodiments of the present invention disclosed above are intended to help understand the content of the present invention and implement it accordingly. It can be understood by those skilled in the art that various replacements, changes and modifications are possible without departing from the spirit and scope of the present invention. The present invention should not be limited to the contents disclosed in the embodiments of this specification, and the scope of protection of the present invention shall be subject to the scope defined in the claims.

Claims

1. A DNS authorization mechanism security threat assessment method based on domain name portrait, characterized in that: The following steps are involved: Obtain the raw data of the domain name system and pre-process it; Use the pre-processed domain name system data to build a domain name security portrait; Perform authorization security threat assessment based on domain name security portraits, including building a global view of vulnerability analysis and conducting threat monitoring.

2. The method according to claim 1, characterized in that The original data of the domain name system includes: zone file data, domain name registration information database, recursive resolver, authoritative domain name server information and configuration data set, national domain name service resolution log, and national domain name security monitoring platform data; the preprocessing includes extracting, cleaning, integrating, and converting the collected domain name data, segmenting, splitting, and formatting and encoding the data, and then designing the database table structure and fields for the data, and connecting the preprocessed data to the corresponding real-time and batch processing big data processing platforms according to real-time and offline analysis attributes.

3. The method according to claim 1, characterized in that: The construction of a domain name security portrait includes: The characteristic labels of domain name security portraits are constructed by combining static data and dynamic detection, including basic attribute labels, dynamic detection labels, and message flow characteristic labels; Based on the characteristic tags of the domain name security portrait, we build single-step authorization portrait, single authorization path portrait, domain name portrait and massive domain name portrait.

4. The method according to claim 3, characterized in that The steps of constructing the single-step authorization portrait include: (1) For a specific domain name, obtain its authorization resource record type based on the authorization attribute information and generate an authorization record tag for single-step authorization; (2) Detect whether the authorization record is authenticated or signed, and generate an authorization security tag; (3) Detecting the authorization type as cross-top-level domain, cross-second-level domain, or local domain authorization, and generating an authorization type label; (4) Verify the basic setting compliance of the authorization resource record type obtained in step (1); (5) After steps (1) to (4) are completed, perform data consistency assessment; (6) Conduct server configuration compliance assessment.

5. The method according to claim 3, characterized in that: The steps of constructing the domain name portrait include: (1) For each single-step authorization involved in domain name resolution, build it in sequence according to the steps of building a single-step authorization portrait; (2) Associating each single-step authorization with each other to generate a domain name authorization relationship network; (3) Generate domain name attribute tags, query domain name registration information through RDAP and Whios protocols, and extract validity period, registrant, registrar, and registration location information; (4) For domestic domain names, query the ICP domain name registration information, determine the industry and purpose of the domain name based on the registration information and suffix information to identify the domain name category; (5) Calculate the authorization record label and authorization type label of the domain name based on the single-step authorization profile of each hop; (6) Generate a domain name authorization record security label based on the single-step authorization profile of each hop; (7) Generate domain name authorization record based on the single-step authorization profile of each hop and set compliance labels; (8) Generate a set of labels related to the consistency of domain name authorization record data based on the single-step authorization profile of each hop; (9) Generate a set of labels related to the rationality of domain name server settings based on the single-step authorization profile of each hop; (10) Select multiple recursive resolver vendors and versions; (11) Detect whether the cache replaces the NS record of the existing parent domain with the NS record in the authoritative response received later; (12) Detect whether the cache replaces the additional segment record of the existing parent domain with the additional segment record in the authoritative response received later; (13) Generate a cache update mechanism tag according to steps (11) and (12), and set its value; (14) Use topological sorting to detect whether there is a circular dependency; (15) Perform path discovery, using the A* algorithm to detect the number of domain name resolution paths and the authorized topological relationship of each path, the path length, and the dependency set of each path; (16) Calculate the minimum dependency set and key dependency nodes of domain name resolution based on the result of step (11), wherein the minimum dependency set is the minimum dependency set required for successful domain name resolution, and the key dependency node is the node that all resolution paths of the domain name need to rely on; (17) The initial weight is set according to the urgency of the label impact, from high to low: causing the domain name to be unable to be resolved, unable to resolve the correct result, and inconsistent resolution results from multiple requests; the domain name can be resolved correctly but has an impact on the resolution performance; the above impacts have not been found so far but it does not meet the configuration specifications and there are potential unsafe vulnerabilities that can be exploited by attackers.

6. The method according to claim 3, characterized in that The steps of constructing the massive domain name portrait include: (1) Develop core indicators based on the research scope; (2) Construct a domain name profile for the domain name set within the research scope; (3) Integrate the results of step (2), count the key dependency node features, calculate the dependency concentration, the company to which the node belongs, count the cross-top-level domain authorization dependency information during the authorization process, and build a massive domain name authorization portrait from the dimensions of dependency concentration, cross-border analysis, and cross-top-level domain dependency.

7. The method according to claim 1, characterized in that The construction of the global view of vulnerability analysis includes: (1) According to the research object and objectives, select and build domain name authorization security portraits based on different dimensions such as single step, single path, single domain name, and massive domain names; (2) Based on the result of step (1), authorization vulnerability analysis is performed according to different dimensions to obtain a global view of vulnerability analysis; the different dimensions include key dependency nodes, shortest paths, key dependency sets, authorization non-compliance items, data consistency, rationality of redundant settings, and dependency concentration; (3) The global view of vulnerability analysis is provided to users through web page visualization and data reports, so that relevant parties can intuitively understand the authorization security risks of related domain names.

8. The method according to claim 1, characterized in that The threat monitoring includes: (1) Construct a training dataset. The training dataset consists of two parts: one is the domain name set in the original data that is threatened by authorized security-related attacks, and the other is the domain name set that is not threatened by attacks; (2) Classify authorized security-related attack threats and label the training set according to whether it has been attacked and the attack category; (3) Construct security profiles for domain names in the training dataset; (4) Building a classification model based on the domain name portrait, using the classification model to determine the conditions that need to be met for different types of attacks to occur, and assessing the threat risks faced by the domain name to be tested; the classification model uses a classification algorithm to perform multi-label classification learning on the training data set, and distinguishes normal domain names from domain names that have been attacked by specific attacks through classification training; (5) Based on the classification model constructed in step (4), the attack risk faced by the domain name to be tested is evaluated and threat assessment and warning are performed.

9. A DNS authorization mechanism security threat assessment system based on domain name portrait, characterized in that: include: A data preprocessing module is used to obtain the original data of the domain name system and preprocess it; A domain name security profile building module is used to build a domain name security profile using pre-processed domain name system data; The authorization security threat assessment module is used to perform authorization security threat assessment based on domain name security portraits, including building a global view of vulnerability analysis and conducting threat monitoring.

10. A computer device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program comprises instructions for executing the method according to any one of claims 1 to 7.

Images