Domain name resolution security detection method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention discloses a domain name resolution security detection method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining a first risk value of a risk domain name resolution server, determining at least one associated domain name resolution server, obtaining a second risk value corresponding to each associated domain name resolution server, and determining at least one associated domain name resolution server; and based on the first risk value corresponding to the risk domain name resolution server and the second risk value corresponding to each associated domain name resolution server, determining the risk value of the resolution target domain name. Therefore, the first risk value of the risk domain name resolution server is determined by using the number of attacks and the attacked type of the risk domain name resolution server in the preset time period, comprehensive assessment of the risk of the risk domain name resolution server is realized, the accuracy of risk assessment of the risk domain name resolution server is improved, and the risk assessment accuracy of the risk domain name resolution server is improved. Therefore, the comprehensiveness and accuracy of analyzing the risk value of the target domain name determined through the first risk value are improved.

Description

Technical Field

[0001] The present disclosure relates to a domain name resolution security assessment technology, and in particular to a domain name resolution security detection method, device, electronic device and storage medium. Background Art

[0002] As an important infrastructure of the Internet, the Domain Name System (DNS) is used to resolve domain names so that users can access the Internet. Since the entire DNS is a huge hierarchical structure, its normal operation requires the participation of multiple servers for domain name resolution. Therefore, during domain name resolution, if one of the participating server nodes is attacked or fails, it may cause a huge chain reaction such as multi-regional Internet failure, thus affecting a large number of users.

[0003] In the related art, in the monitoring of domain name resolution security, it is usually aimed at monitoring a certain type of threat to the server, for example, monitoring of the distributed denial of service attack (DDoS) attack or DNS hijacking suffered by the server. However, the server in the DNS can be subject to multiple threats, which makes the security assessment of the domain name resolution through the monitoring results of the monitored server incomplete, resulting in inaccurate security assessment of the domain name resolution. Summary of the invention

[0004] In order to solve the above technical problems, the embodiments of the present disclosure provide a domain name security detection method, device, electronic device and storage medium.

[0005] One aspect of an embodiment of the present disclosure provides a domain name resolution security detection method, including: in response to detecting the presence of an abnormal risky domain name resolution server in each target domain name resolution service, obtaining the number of attacks and / or the type of attacks on the risky domain name resolution server in a preset time period, the target domain name resolution server including each domain name resolution service corresponding to the target domain name, and / or each domain name resolution server corresponding to the alias corresponding to the target domain name; based on the number of attacks and / or the type of attacks corresponding to the risky domain name resolution server, determining a first risk value of the risky domain name resolution server; according to the target area name corresponding to the risky domain name resolution server, determining at least one associated domain name in each domain name resolution server A resolution server, wherein each associated domain name resolution server in the at least one associated domain name resolution server is used to resolve a target area name, wherein the target area name is composed of at least one first-level domain name in the target domain name, or is composed of at least one first-level domain name in the alias; for each associated domain name resolution server, obtaining a weight value and an initial risk value respectively corresponding to the associated domain name resolution server; determining a second risk value corresponding to the associated domain name resolution server based on the weight value and the initial risk value respectively corresponding to the associated domain name resolution server; determining a risk value for resolving the target domain name based on a first risk value corresponding to the risk domain name resolution server and a second risk value respectively corresponding to each associated domain name resolution server.

[0006] Another aspect of the disclosed embodiments provides a domain name resolution security detection device, including: a risk server determination module, for obtaining the number of attacks and / or the type of attacks on the risk domain name resolution server in a preset time period in response to detecting an abnormal risk domain name resolution server in each target domain name resolution service, wherein the target domain name resolution server includes each domain name resolution service corresponding to the target domain name, and / or each domain name resolution server corresponding to the alias corresponding to the target domain name; a first risk determination module, for determining a first risk value of the risk domain name resolution server based on the number of attacks and / or the type of attacks corresponding to the risk domain name resolution server; an association determination module, for determining at least one associated domain name in each domain name resolution server according to the target area name corresponding to the risk domain name resolution server. A resolution server, each of the at least one associated domain name resolution server is used to resolve the target area name, and the target area name is composed of at least one first-level domain name in the target domain name, or is composed of at least one first-level domain name in the alias; a second risk determination module is used to obtain, for each associated domain name resolution server, the weight value and the initial risk value respectively corresponding to the associated domain name resolution server; a third risk determination module is used to determine the second risk value corresponding to the associated domain name resolution server based on the weight value and the initial risk value respectively corresponding to the associated domain name resolution server; a fourth risk determination module is used to determine the risk value of resolving the target domain name based on the first risk value corresponding to the risk domain name resolution server and the second risk value respectively corresponding to each associated domain name resolution server.

[0007] Another aspect of the embodiments of the present disclosure provides an electronic device, comprising: a memory for storing a computer program; a processor for executing the computer program stored in the memory, and when the computer program is executed, the above-mentioned domain name resolution security detection method is implemented.

[0008] Another aspect of the embodiments of the present disclosure provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the above-mentioned domain name resolution security detection method.

[0009] In the embodiment of the present disclosure, when an abnormal risky domain name resolution server is detected in each target domain name resolution service, the number of attacks and / or the type of attacks on the risky domain name resolution server in a preset time period is obtained, and then the first risk value of the risky domain name resolution server is determined based on the number of attacks and / or the type of attacks corresponding to the risky domain name resolution server, and then at least one associated domain name resolution server is determined in each domain name resolution server according to the target area name corresponding to the risky domain name resolution server, and the weight value and initial risk value corresponding to each associated domain name resolution server are obtained, and the second risk value corresponding to each associated domain name resolution server is determined based on the weight value and initial risk value corresponding to each associated domain name resolution server, and the risk value of the target domain name resolution is determined based on the first risk value corresponding to the risky domain name resolution server and the second risk value corresponding to each associated domain name resolution server. Therefore, in the embodiment of the present disclosure, the first risk value of the risky domain name resolution server is determined by using the number of attacks and the type of attacks on the risky domain name resolution server in the preset time period, so as to achieve a comprehensive assessment of the risk of the risky domain name resolution server, improve the accuracy of the risk assessment of the risky domain name resolution server, and thus improve the comprehensiveness and accuracy of the risk value of the target domain name resolution determined by the first risk value.

[0010] In addition, in the disclosed embodiment, the associated domain name resolution server is determined by the target zone name corresponding to the risky domain name resolution server, and the risk value of the resolved target domain name is determined based on the second risk value corresponding to each associated domain name resolution server and the first risk value corresponding to the risky domain name. This ensures that when determining the risk value of the resolved target domain name, the risks of each domain name resolution server that resolves the target domain name are comprehensively considered, further improving the comprehensiveness and accuracy of the risk value of the resolved target domain name.

[0011] The technical solution of the present disclosure is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The accompanying drawings, which constitute a part of the specification, illustrate embodiments of the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0013] The present disclosure may be more clearly understood from the following detailed description with reference to the accompanying drawings, in which: Figure 1 It is a flowchart of a domain name resolution security detection method provided by an exemplary embodiment of the present disclosure; Figure 2 is a flowchart of step S120 provided by an exemplary embodiment of the present disclosure; Figure 3 is a flowchart of step S150 provided by an exemplary embodiment of the present disclosure; Figure 4 is a domain name resolution dependency graph corresponding to a target domain name provided by an exemplary embodiment of the present disclosure; Figure 5 It is a structural diagram of a domain name resolution security detection device provided by an exemplary embodiment of the present disclosure; Figure 6 The figure is a schematic diagram of the structure of an application embodiment of the electronic device disclosed in the present invention. DETAILED DESCRIPTION

[0014] Various exemplary embodiments of the present disclosure will now be described in detail with reference to the accompanying drawings. It should be noted that the relative arrangement of components and steps, numerical expressions and numerical values ​​set forth in these embodiments do not limit the scope of the present disclosure unless otherwise specifically stated.

[0015] Those skilled in the art can understand that the terms "first" and "second" in the embodiments of the present disclosure are only used to distinguish different steps, devices or modules, etc., and neither represent any specific technical meaning nor indicate the necessary logical order between them.

[0016] It should also be understood that in the embodiments of the present disclosure, “plurality” may refer to two or more than two, and “at least one” may refer to one, two, or more than two.

[0017] It should also be understood that any component, data or structure mentioned in the embodiments of the present disclosure can generally be understood as one or more, unless explicitly limited or otherwise indicated in the context.

[0018] In addition, the term "and / or" in the present disclosure is only a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in the present disclosure generally indicates that the associated objects before and after are in an "or" relationship.

[0019] It should also be understood that the description of the various embodiments in the present disclosure focuses on the differences between the various embodiments, and the same or similar aspects thereof can be referenced to each other, and for the sake of brevity, they will not be described one by one.

[0020] At the same time, it should be understood that for the convenience of description, the sizes of the various parts shown in the drawings are not drawn according to the actual proportional relationship.

[0021] The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way intended to limit the present disclosure, its application, or uses.

[0022] Technologies, methods, and equipment known to ordinary technicians in the relevant art may not be discussed in detail, but where appropriate, the technologies, methods, and equipment should be considered part of the specification.

[0023] It should be noted that like reference numerals and letters refer to similar items in the following figures, and therefore, once an item is defined in one figure, it need not be further discussed in subsequent figures.

[0024] The embodiments of the present disclosure can be applied to electronic devices such as terminal devices, computer systems, servers, etc., which can operate with many other general or special computing system environments or configurations. Examples of well-known terminal devices, computing systems, environments and / or configurations suitable for use with electronic devices such as terminal devices, computer systems, servers, etc. include, but are not limited to: personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, microprocessor-based systems, set-top boxes, programmable consumer electronics, network personal computers, small computer systems, large computer systems, and distributed cloud computing technology environments including any of the above systems, etc.

[0025] Electronic devices such as terminal devices, computer systems, servers, etc. can be described in the general context of computer system executable instructions (such as program modules) executed by computer systems. Generally, program modules can include routines, programs, object programs, components, logic, data structures, etc., which perform specific tasks or implement specific abstract data types. Computer systems / servers can be implemented in distributed cloud computing environments, where tasks are performed by remote processing devices linked through a communication network. In a distributed cloud computing environment, program modules can be located on local or remote computing system storage media including storage devices.

[0026] Figure 1 FIG. 1 is a flowchart of a domain name resolution security detection method provided by an exemplary embodiment of the present disclosure. This embodiment can be applied to electronic devices, such as Figure 1 As shown, the domain name resolution security detection method includes the following steps: Step S100, in response to detecting an abnormal risky domain name resolution server in each target domain name resolution service, obtaining the number of attacks and / or the type of attacks on the risky domain name resolution server in a preset period of time.

[0027] In this embodiment, the domain name resolution server that performs domain name resolution for the target domain name and the domain name resolution server that performs domain name resolution for the alias (CNAME) of the target domain name may be referred to as the target domain name resolution server. The alias of the target domain name is also a domain name.

[0028] The target domain name resolution server includes domain name resolution services corresponding to the target domain name and / or domain name resolution servers corresponding to an alias corresponding to the target domain name.

[0029] In one embodiment, the attack type is used to indicate the type of attack suffered by the target domain name resolution server. The attack type may include, for example, at least one of the following: DDoS, DNS hijacking, cross-site scripting attack (Cross Site Scripting, XSS attack), session hijacking attack and malformed message attack (Teardrop attack), etc.

[0030] Each target domain name resolution server can be tested at preset intervals or before resolving the target domain name to determine whether the target domain name resolution server is abnormal, and when the target domain name resolution server is determined to be abnormal, the target domain name resolution server is determined to be a risky domain name resolution server. The target domain name resolution server can be determined to be abnormal when the traffic of the target domain name resolution server is abnormal, the performance is degraded, or it does not respond for a certain period of time.

[0031] Step S110: determining a first risk value of the risky domain name resolution server based on the number of attacks and / or the type of attacks corresponding to the risky domain name resolution server.

[0032] In the embodiment of the present disclosure, the risk value corresponding to the risky domain name resolution server may be referred to as a first risk value.

[0033] In one embodiment, the correspondence between the number of attacks and the score, and the correspondence between the attack type and the score can be preset. The target domain name resolution server can correspond to one attack type or multiple attack types.

[0034] The log of the risky domain name resolution server can be obtained, and the number of attacks and the attack type of the target domain name resolution server in a preset time period can be obtained according to the log. The first score can be determined based on the correspondence between the preset number of attacks and the score, and the number of attacks on the risky domain name resolution server in the preset time period, and the score corresponding to each attack type can be determined based on the correspondence between the preset attack type and the score, and each attack type of the risky domain name resolution server in the preset time period, and the sum of the scores corresponding to each attack type is used as the second score, and the sum of the first score and the second score is determined as the first risk value.

[0035] Step S120: determining at least one associated domain name resolution server from among the domain name resolution servers according to the target zone name corresponding to the risky domain name resolution server.

[0036] Among them, each associated domain name resolution server in at least one associated domain name resolution server is used to resolve the target zone name; the target zone name is composed of at least one first-level domain name in the target domain name, or is composed of at least one first-level domain name in the alias.

[0037] The region name of the target domain name resolved by the risky domain name resolution server and / or the region name of the alias may be determined as the target region name.

[0038] A domain name is a method used to resolve an Internet Protocol Address (IP address) on the Internet. A complete domain name consists of two or more parts, each separated by an English period ".". The part to the right of the last "." is called the Top-Level Domain (TLD), also known as the First-Level Domain. The part to the left of the last "." is called the Second-Level Domain (SLD). The part to the left of the Second-Level Domain is called the Third-Level Domain, and so on. Each level of domain name controls the allocation of the next level of domain names.

[0039] The target domain name may include multiple region names, each of which is composed of at least one first-level domain name in the target domain name; the alias may include multiple region names, each of which is composed of at least one first-level domain name in the alias.

[0040] The domain name resolution server used to resolve the ancestor domain name of the target domain name can be determined as the associated domain name resolution server. The domain name resolution server that is responsible for resolving the domain name corresponding to the IP address obtained by resolving a domain name is determined as the ancestor domain name of the domain name, and the ancestor domain name includes the domain name.

[0041] Exemplarily, assume that the target domain name can be www.example1.com, and the alias of the target domain name can be www.example2.com; com is the top-level domain name, example1 and example2 are second-level domain names, and www is the third-level domain name. The zone names of the target domain name can include: com and example1.com, and the zone names of the alias can include: com and example2.com.

[0042] By resolving the domain name of com (the target zone name), the IP addresses of the domain name resolution servers that resolve example1.com and example2.com can be obtained. Therefore, example1.com and example2.com are both ancestor zone names of com. The domain name resolution servers that resolve example1.com and example2.com can be determined as associated domain name resolution servers.

[0043] Step S130: For each associated domain name resolution server, obtain the weight value and initial risk value respectively corresponding to the associated domain name resolution server.

[0044] In one implementation, a correspondence between a preset domain name resolution server and a weight value may be preset, and the weight value corresponding to the associated domain name resolution server may be determined according to the correspondence between the preset domain name resolution server and the weight value.

[0045] The initial risk value corresponding to the associated domain name resolution server may be determined according to the number of times the associated domain name resolution server is attacked within a preset period of time and the corresponding relationship between the preset number of times of attack and the score.

[0046] Step S140: determining a second risk value corresponding to the associated domain name resolution server based on the weight value and the initial risk value respectively corresponding to the associated domain name resolution server.

[0047] In the embodiment of the present disclosure, the risk value corresponding to the associated domain name resolution server may be referred to as a second risk value.

[0048] The product of the weight value and the initial risk value may be determined as the second risk value corresponding to the associated domain name resolution server.

[0049] Step S150: determining the risk value of the target domain name to be resolved based on the first risk value corresponding to the risky domain name resolution server and the second risk values ​​corresponding to each associated domain name resolution server.

[0050] The risk value of resolving the target domain name may be used to indicate the risk situation of resolving the target domain name.

[0051] In one implementation, the sum of the first risk value and each second risk value may be determined as the risk value of resolving the target domain name.

[0052] In one embodiment, when the ancestor zone name of the target zone name is the target domain name or alias, the first risk value can be determined as the risk value of resolving the target domain name. For example, for the target domain name www.example1.com, the IP address of the domain name resolution server that resolves www. example1.com can be obtained by resolving the domain name of example1.com (target zone name), then www.example1.com is the ancestor zone name of example1.com, and at this time, the ancestor zone name of example1.com is the target domain name, and the first risk value is determined as the risk value of resolving the target domain name.

[0053] In the disclosed embodiment, the first risk value of the risky domain name resolution server is determined by using the number of attacks and the type of attacks on the risky domain name resolution server in a preset period, thereby achieving a comprehensive assessment of the risk of the risky domain name resolution server, improving the accuracy of the risk assessment of the risky domain name resolution server, and thus improving the comprehensiveness and accuracy of the risk value of the resolved target domain name determined by the first risk value. In addition, in the disclosed embodiment, the associated domain name resolution server is determined by the target area name corresponding to the risky domain name resolution server, and the risk value of the resolved target domain name is determined based on the second risk value corresponding to each associated domain name resolution server and the first risk value corresponding to the risky domain name, so that when determining the risk value of the resolved target domain name, the risks of each domain name resolution server that resolves the target domain name are comprehensively considered, further improving the comprehensiveness and accuracy of the risk value of the resolved target domain name obtained.

[0054] Figure 2 FIG. 1 is a flow chart of step S120 provided by an exemplary embodiment of the present disclosure. In some optional implementations, step S120 may include the following steps: Step S121, obtaining domain name resolution information corresponding to the target domain name.

[0055] The domain name resolution information includes: the resolution relationship between the zone name and the domain name resolution server, and the dependency relationship between the zone names.

[0056] The resolution relationship between the zone name and the domain name resolution server is used to represent the resolution relationship of the domain name resolution server to the zone name; the dependency relationship between zone names is used to represent the corresponding relationship between the zone name and its ancestor zone.

[0057] Step S122: determining the target area name based on the risky domain name resolution server and the resolution relationship between the area name and the domain name resolution server.

[0058] Wherein, based on the resolution relationship between the zone name and the domain name resolution server, the zone name resolved by the risk domain name resolution server is determined, and the zone name is determined as the target zone name.

[0059] Step S123, determining each associated domain name resolution server based on the target zone name, the resolution relationship between the zone name and the domain name resolution server, and the dependency relationship between the zone names.

[0060] Among them, the ancestor region name of the target region name can be determined based on the dependency relationship between the target region name and the region name, and then the domain name resolution servers used to resolve the ancestor region name can be determined based on the ancestor region name and the resolution relationship between the region name and the domain name resolution server, and the domain name resolution servers can be determined as associated domain name resolution servers.

[0061] In some optional embodiments, in the implementation of the present disclosure, step S130 may include: for each associated domain name resolution server, obtaining the number of attacks and / or the type of attacks on the associated domain name resolution server within a preset time period, and then determining the initial risk value corresponding to the associated domain name resolution server based on the number of attacks and / or the type of attacks corresponding to the associated domain name resolution server.

[0062] In one implementation, the associated domain name resolution server may correspond to one attacked type or may correspond to multiple attacked types.

[0063] The log of the associated domain name resolution server can be obtained, and the number of attacks and the attack type of the associated domain name resolution server in a preset time period can be obtained according to the log. The third score can be determined based on the correspondence between the preset number of attacks and the score and the number of attacks on the associated domain name resolution server in the preset time period, and the score corresponding to each attack type can be determined based on the correspondence between the preset attack type and the score and each attack type of the associated domain name resolution server in the preset time period, and the sum of the scores corresponding to each attack type is used as the fourth score, and the sum of the third score and the fourth score is determined as the initial risk value corresponding to the associated domain name resolution server.

[0064] In some optional implementations, in the implementation of the present disclosure, step S130 may also include: determining a weight value corresponding to the associated domain name resolution server according to a correspondence between a preset domain name resolution server and a weight value.

[0065] The correspondence between the preset domain name resolution server and the weight value includes the weight values ​​corresponding to the multiple domain name resolution servers. The weight value corresponding to each associated domain name resolution server can be determined according to the correspondence between the preset domain name resolution server and the weight value.

[0066] Figure 3 FIG. 1 is a flow chart of step S150 provided by an exemplary embodiment of the present disclosure. In some optional implementations, step S150 may include the following steps: Step S151: determining an associated risk value based on the second risk value corresponding to each associated domain name resolution server.

[0067] Among them, when each associated domain name resolution server resolves the same zone name, the associated risk value can be determined by formula (1); Formula (1) R1 to Rn in formula (1) represent the second risk value of the first associated domain name resolution server to the second risk value of the nth associated domain name resolution server, respectively, and n is an integer greater than 2.

[0068] When the associated domain name resolution server resolves two or more zone names, the associated domain name resolution servers that resolve the same zone name can be set in a set, and the intermediate risk value corresponding to each set is calculated using formula (1) and the second risk value corresponding to each associated domain name resolution server in each set. Then, based on each intermediate risk value, the associated risk value is calculated using formula (2).

[0069] Formula (2) M1~Mn in formula (2) represent the first intermediate risk value to the nth intermediate risk value respectively.

[0070] Exemplarily, the example in step S120 is used for illustration. Assuming that the domain name resolution servers for resolving example1.com are domain name resolution server 1 and domain name resolution server 2, and the domain name resolution servers for resolving example2.com are domain name resolution server 3 and domain name resolution server 4, the associated domain name resolution servers include resolution server 1 to resolution server 4.

[0071] According to the second risk values ​​corresponding to domain name resolution server 1 and domain name resolution server 2, respectively, the first intermediate risk value is calculated using formula (1); according to the second risk values ​​corresponding to domain name resolution server 3 and domain name resolution server 4, respectively, the second intermediate risk value is calculated using formula (1); according to the first intermediate risk value and the second intermediate risk value, the associated risk value is calculated using formula (2).

[0072] Step S152: determining the risk value of resolving the target domain name based on the associated risk value and the first risk value.

[0073] In one implementation, the sum of the first risk value and the associated risk value may be determined as the risk value of resolving the target domain name.

[0074] In some optional embodiments, the domain name resolution security detection method in the embodiment of the present disclosure may also include: in response to the target domain name corresponding to the alias, using the target domain name, the regional names and domain name resolution servers corresponding to the target domain name, and the alias, the regional names and domain name resolution servers corresponding to the alias as nodes, and using the resolution relationship between the regional name and the domain name resolution server, the correspondence between the target domain name and the alias, and the dependency relationship between the regional names as edges, to generate a domain name resolution dependency graph corresponding to the target domain name.

[0075] In one implementation, a domain name resolution process may be performed on the target domain name to obtain a domain name resolution message of the target domain name, and to create a node list and an edge list.

[0076] When the answer segment in the message includes a CNAME record, it is determined that the target domain name has an alias, the alias is obtained from the CNAME record, and each regional name corresponding to the target domain name, each regional name corresponding to the alias, a domain name resolution server for resolving each regional name corresponding to the target domain name, and a domain name resolution server for resolving each regional name corresponding to the alias are obtained from the authorization field in the message, and the target domain name, the alias, each regional name corresponding to the target domain name, each regional name corresponding to the alias, a domain name resolution server for resolving each regional name corresponding to the target domain name, and a domain name resolution server for resolving each regional name corresponding to the alias are recorded as nodes in the node list; An edge is established between each zone name and the domain name resolution server that resolves the zone name, that is, the resolution relationship between the zone name and the domain name resolution server is the edge, and the edge is recorded in the edge table; an edge is established between the target domain name and the alias, that is, the corresponding relationship between the target domain name and the alias is the edge, and the edge is recorded in the edge table; an edge is established between each zone name and the ancestor zone name of the zone name, that is, the dependency relationship between the zone names is the edge, and the edge is recorded in the edge table. Use the node list and edge list to create a domain name resolution dependency graph corresponding to the target domain name.

[0077] For example, Figure 4 This is a domain name resolution dependency graph corresponding to a target domain name provided by an exemplary embodiment of the present disclosure. www.example1.com is the target domain name, www.example2.com is the alias of the target domain name, com, example1.com, and example2.com are zone names, a1 to an are domain name resolution servers for zone name example1.com domain name resolution, b1 to bn are domain name resolution servers for zone name example2.com domain name resolution, c1 to cn are domain name resolution servers for zone name com domain name resolution, PDD represents the dependency relationship between zone names, and NS represents the domain name resolution server.

[0078] In an optional implementation, in an embodiment of the present disclosure, in response to the target domain name not having a corresponding alias, a domain name resolution dependency graph corresponding to the target domain name is generated with the target domain name, the regional names corresponding to the target domain name, and the domain name resolution servers as nodes, and the resolution relationship between the regional name and the domain name resolution server, the correspondence relationship between the target domain name and the alias, and the dependency relationship between the regional names as edges.

[0079] Among them, the method of generating a domain name resolution dependency graph that does not include aliases can refer to the above-mentioned method of generating a domain name resolution dependency graph that includes aliases, which will not be repeated here.

[0080] Accordingly, in the disclosed embodiment, step S121 may include: determining the domain name resolution information corresponding to the target domain name based on the domain name resolution dependency graph corresponding to the target domain name.

[0081] In some optional implementations, the domain name resolution security detection method in the embodiment of the present disclosure may further include: in response to a risk value of resolving the target domain name exceeding a preset risk threshold, performing an alarm process.

[0082] Among them, a preset risk threshold can be set in advance. When the risk value of the resolved target domain name exceeds the preset risk threshold, an alarm process can be performed to provide a prompt. When the risk value of the resolved target domain name does not exceed the preset risk threshold, no process is performed.

[0083] Figure 5 FIG. 1 is a schematic diagram of a domain name resolution security detection device provided by an exemplary embodiment of the present disclosure. Figure 5 As shown, the device of this embodiment may include: The risk server determination module 200 is used to obtain the number of attacks and / or the attack type of the risky domain name resolution server in a preset period of time in response to detecting an abnormal risky domain name resolution server in each target domain name resolution service, wherein the target domain name resolution server includes each domain name resolution service corresponding to the target domain name, and / or each domain name resolution server corresponding to the alias corresponding to the target domain name; A first risk determination module 210, configured to determine a first risk value of the risky domain name resolution server based on the number of attacks and / or the type of attacks corresponding to the risky domain name resolution server; The association determination module 220 is used to determine at least one associated domain name resolution server among the domain name resolution servers according to the target zone name corresponding to the risk domain name resolution server, each associated domain name resolution server among the at least one associated domain name resolution server is used to resolve the target zone name, and the target zone name is composed of at least one first-level domain name in the target domain name, or is composed of at least one first-level domain name in the alias; The second risk determination module 230 is used to obtain, for each associated domain name resolution server, a weight value and an initial risk value respectively corresponding to the associated domain name resolution server; A third risk determination module 240, configured to determine a second risk value corresponding to the associated domain name resolution server based on the weight values ​​and initial risk values ​​respectively corresponding to the associated domain name resolution servers; The fourth risk determination module 250 is used to determine the risk value of resolving the target domain name based on the first risk value corresponding to the risky domain name resolution server and the second risk values ​​corresponding to each associated domain name resolution server.

[0084] In some possible implementations of the present disclosure, the association determination module 220 includes: The first submodule is used to obtain the domain name resolution information corresponding to the target domain name, wherein the domain name resolution information includes the resolution relationship between the zone name and the domain name resolution server, and the dependency relationship between the zone names; The second submodule is used to determine the target area name based on the risk domain name resolution server and the resolution relationship between the area name and the domain name resolution server; The third submodule is used to determine the associated domain name resolution servers based on the target area name, the resolution relationship between the area name and the domain name resolution server, and the dependency relationship between the area names.

[0085] In some possible implementations of the present disclosure, obtaining the initial risk value corresponding to the associated domain name resolution server is further used to: Obtaining the number of attacks and / or the type of attacks on the associated domain name resolution server within a preset period of time; The initial risk value is determined based on the number of attacks and / or the type of attacks corresponding to the associated domain name resolution server.

[0086] In some possible implementations of the present disclosure, obtaining a weight value corresponding to the associated domain name resolution server is further used to: According to the correspondence between the preset domain name resolution server and the weight value, the weight value corresponding to the associated domain name resolution server is determined.

[0087] In some possible implementations of the present disclosure, the fourth risk determination module 250 is specifically used to: determine an associated risk value based on the second risk value corresponding to each associated domain name resolution server; and determine a risk value for resolving the target domain name based on the associated risk value and the first risk value.

[0088] In some possible implementations of the present disclosure, the device further includes: A first image generation module is used for, in response to the target domain name corresponding to the alias, generating a domain name resolution dependency graph corresponding to the target domain name by taking the target domain name, each area name and each domain name resolution server corresponding to the target domain name, and the alias, each area name and each domain name resolution server corresponding to the alias as nodes, and taking the resolution relationship between the area name and the domain name resolution server, the correspondence relationship between the target domain name and the alias, and the dependency relationship between the area names as edges; a second image generation module, configured to generate, in response to the target domain name not corresponding to the alias, a domain name resolution dependency graph corresponding to the target domain name, using the target domain name, each area name corresponding to the target domain name, and each domain name resolution server as nodes, and using the resolution relationship between the area name and the domain name resolution server, the correspondence relationship between the target domain name and the alias, and the dependency relationship between the area names as edges; The first submodule is specifically used to determine the domain name resolution information corresponding to the target domain name based on the domain name resolution dependency graph corresponding to the target domain name.

[0089] In some possible implementations of the present disclosure, the device further includes: The alarm module is used to perform alarm processing in response to the risk value of resolving the target domain name exceeding a preset risk threshold.

[0090] The domain name resolution security detection device of the embodiment of the present disclosure corresponds to the embodiment of the domain name resolution security detection method of the present disclosure, and the relevant contents can be referenced to each other and will not be repeated here.

[0091] The beneficial technical effects corresponding to the exemplary embodiments of the domain name resolution security detection device of the disclosed embodiments can be found in the corresponding beneficial technical effects of the above-mentioned corresponding exemplary method part, which will not be repeated here.

[0092] In addition, an embodiment of the present disclosure further provides an electronic device, including: Memory for storing computer programs; The processor is used to execute the computer program stored in the memory, and when the computer program is executed, the domain name resolution security detection method described in any of the above embodiments of the present disclosure is implemented.

[0093] Figure 6 This is a schematic diagram of the structure of an application embodiment of the electronic device disclosed in the present invention. Figure 6 The electronic device according to the embodiment of the present disclosure is described. The electronic device may be any one or both of the first device and the second device, or a stand-alone device independent of them, and the stand-alone device may communicate with the first device and the second device to receive the collected input signals from them.

[0094] like Figure 6 As shown, the electronic device includes one or more processors and memory.

[0095] The processor may be a central processing unit (CPU) or other forms of processing units having data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device to perform desired functions.

[0096] The memory may include one or more computer program products, and the computer program product may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory (cache), etc. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor may run the program instructions to implement the domain name resolution security detection method of each embodiment of the present disclosure described above and / or other desired functions.

[0097] In one example, the electronic device may further include: an input device and an output device, and these components are interconnected via a bus system and / or other forms of connection mechanisms (not shown).

[0098] In addition, the input device may also include, for example, a keyboard, a mouse, and the like.

[0099] The output device can output various information to the outside, including the determined distance information, direction information, etc. The output device can include, for example, a display, a speaker, a printer, a communication network and a remote output device connected thereto, and the like.

[0100] Of course, to simplify, Figure 6 Only some of the components related to the present disclosure in the electronic device are shown, and components such as a bus, an input / output interface, etc. are omitted. In addition, according to specific application situations, the electronic device may further include any other appropriate components.

[0101] In addition to the above-mentioned methods and devices, an embodiment of the present disclosure may also be a computer program product, which includes computer program instructions, which, when executed by a processor, enable the processor to execute the steps of the domain name resolution security detection method according to various embodiments of the present disclosure described in the above part of this specification.

[0102] The computer program product may be written in any combination of one or more programming languages ​​to write program code for performing the operations of the disclosed embodiments, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0103] In addition, an embodiment of the present disclosure may also be a computer-readable storage medium on which computer program instructions are stored. When the computer program instructions are executed by a processor, the processor executes the steps of the domain name resolution security detection method according to various embodiments of the present disclosure described in the above part of this specification.

[0104] The computer readable storage medium can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can include, for example, but is not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0105] A person of ordinary skill in the art can understand that all or part of the steps of implementing the above method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiment; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk, etc., various media that can store program codes.

[0106] The basic principles of the present disclosure are described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, effects, etc. mentioned in the present disclosure are only examples and not limitations, and it cannot be considered that these advantages, strengths, effects, etc. are required by each embodiment of the present disclosure. In addition, the specific details disclosed above are only for the purpose of illustration and ease of understanding, and are not limitations. The above details do not limit the present disclosure to the necessity of adopting the above specific details to be implemented.

[0107] Each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the system embodiment, since it basically corresponds to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0108] The block diagrams of the devices, apparatuses, equipment, and systems involved in this disclosure are only illustrative examples and are not intended to require or imply that they must be connected, arranged, and configured in the manner shown in the block diagrams. As will be appreciated by those skilled in the art, these devices, apparatuses, equipment, and systems can be connected, arranged, and configured in any manner. Words such as "including," "comprising," "having," and the like are open words, referring to "including but not limited to," and can be used interchangeably therewith. The words "or" and "and" used herein refer to the words "and / or," and can be used interchangeably therewith, unless the context clearly indicates otherwise. The word "such as" used herein refers to the phrase "such as but not limited to," and can be used interchangeably therewith.

[0109] The method and apparatus of the present disclosure may be implemented in many ways. For example, the method and apparatus of the present disclosure may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above order of steps for the method is for illustration only, and the steps of the method of the present disclosure are not limited to the order specifically described above, unless otherwise specifically stated. In addition, in some embodiments, the present disclosure may also be implemented as a program recorded in a recording medium, which includes machine-readable instructions for implementing the method according to the present disclosure. Therefore, the present disclosure also covers a recording medium storing a program for executing the method according to the present disclosure.

[0110] It should also be noted that in the apparatus, device and method of the present disclosure, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present disclosure.

[0111] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the aspects shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

[0112] The above description has been given for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although multiple example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, changes, additions and sub-combinations thereof.

Claims

1. A domain name resolution security detection method, characterized in that: include: In response to detecting an abnormal risky domain name resolution server in each target domain name resolution service, obtaining the number of attacks and / or the attack type of the risky domain name resolution server in a preset period of time, the target domain name resolution server includes each domain name resolution service corresponding to the target domain name, and / or each domain name resolution server corresponding to the alias corresponding to the target domain name; Determine a first risk value of the risky domain name resolution server based on the number of attacks and / or the type of attacks corresponding to the risky domain name resolution server; According to the target zone name corresponding to the risky domain name resolution server, at least one associated domain name resolution server is determined in each of the domain name resolution servers, each of the at least one associated domain name resolution server is used to resolve the target zone name, and the target zone name is composed of at least one first-level domain name in the target domain name, or is composed of at least one first-level domain name in the alias; For each of the associated domain name resolution servers, obtaining a weight value and an initial risk value respectively corresponding to the associated domain name resolution server; Determine a second risk value corresponding to the associated domain name resolution server based on the weight values ​​and initial risk values ​​respectively corresponding to the associated domain name resolution servers; The risk value of resolving the target domain name is determined based on the first risk value corresponding to the risky domain name resolution server and the second risk values ​​respectively corresponding to each associated domain name resolution server.

2. The method according to claim 1, characterized in that The step of determining at least one associated domain name resolution server from among the domain name resolution servers according to the target zone name corresponding to the risky domain name resolution server includes: Obtaining domain name resolution information corresponding to the target domain name, the domain name resolution information including a resolution relationship between a zone name and a domain name resolution server, and a dependency relationship between zone names; Determine the target area name based on the risk domain name resolution server and the resolution relationship between the area name and the domain name resolution server; The associated domain name resolution servers are determined based on the target area name, the resolution relationship between the area name and the domain name resolution server, and the dependency relationship between the area names.

3. The method according to claim 2, characterized in that Obtaining an initial risk value corresponding to the associated domain name resolution server includes: Obtaining the number of attacks and / or the type of attacks on the associated domain name resolution server within a preset period of time; The initial risk value is determined based on the number of attacks and / or the type of attacks corresponding to the associated domain name resolution server.

4. The method according to claim 3, characterized in that Obtaining the weight value corresponding to the associated domain name resolution server includes: According to the correspondence between the preset domain name resolution server and the weight value, the weight value corresponding to the associated domain name resolution server is determined.

5. The method according to claim 2, characterized in that: The determining the risk value of resolving the target domain name based on the first risk value corresponding to the risky domain name resolution server and the second risk values ​​respectively corresponding to each associated domain name resolution server includes: Determining an associated risk value based on the second risk value corresponding to each associated domain name resolution server; A risk value for resolving the target domain name is determined based on the associated risk value and the first risk value.

6. The method according to claim 2, characterized in that Also includes: In response to the target domain name corresponding to the alias, a domain name resolution dependency graph corresponding to the target domain name is generated with the target domain name, each area name and each domain name resolution server corresponding to the target domain name, and the alias, each area name and each domain name resolution server corresponding to the alias as nodes, and with the resolution relationship between the area name and the domain name resolution server, the corresponding relationship between the target domain name and the alias, and the dependency relationship between the area names as edges; In response to the target domain name not corresponding to the alias, a domain name resolution dependency graph corresponding to the target domain name is generated, with the target domain name, each zone name corresponding to the target domain name, and each domain name resolution server as nodes, and with the resolution relationship between the zone name and the domain name resolution server, the correspondence relationship between the target domain name and the alias, and the dependency relationship between the zone names as edges; The obtaining of the domain name resolution information corresponding to the target domain name includes: Based on the domain name resolution dependency graph corresponding to the target domain name, domain name resolution information corresponding to the target domain name is determined.

7. The method according to any one of claims 1 to 6, characterized in that: Also includes: In response to the risk value of parsing the target domain name exceeding a preset risk threshold, an alarm process is performed.

8. A domain name resolution security detection device, characterized in that: include: A risk server determination module is used to obtain the number of attacks and / or the type of attacks on the risky domain name resolution server in a preset period of time in response to detecting an abnormal risky domain name resolution server in each target domain name resolution service, wherein the target domain name resolution server includes each domain name resolution service corresponding to the target domain name, and / or each domain name resolution server corresponding to the alias corresponding to the target domain name; A first risk determination module, configured to determine a first risk value of the risky domain name resolution server based on the number of attacks and / or the type of attacks corresponding to the risky domain name resolution server; an association determination module, configured to determine at least one associated domain name resolution server among the domain name resolution servers according to the target zone name corresponding to the risk domain name resolution server, wherein each associated domain name resolution server among the at least one associated domain name resolution server is configured to resolve the target zone name, and the target zone name is composed of at least one first-level domain name in the target domain name, or is composed of at least one first-level domain name in the alias; A second risk determination module is used to obtain, for each associated domain name resolution server, a weight value and an initial risk value respectively corresponding to the associated domain name resolution server; A third risk determination module, configured to determine a second risk value corresponding to the associated domain name resolution server based on the weight values ​​and initial risk values ​​respectively corresponding to the associated domain name resolution servers; The fourth risk determination module is used to determine the risk value of resolving the target domain name based on the first risk value corresponding to the risky domain name resolution server and the second risk values ​​respectively corresponding to each associated domain name resolution server.

9. An electronic device, characterized in that: include: Memory for storing computer programs; The processor is used to execute the computer program stored in the memory, and when the computer program is executed, the domain name resolution security detection method described in any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the domain name resolution security detection method described in any one of claims 1 to 7 is implemented.

Images