Domain name resolution security detection method, device, electronic device and storage medium

Abstract

The disclosed embodiment discloses a domain name resolution security detection method, device, electronic device and storage medium, the method comprising: obtaining a first risk value of a risky domain name resolution server, determining at least one associated domain name resolution server, obtaining a second risk value corresponding to each associated domain name resolution server, and determining the risk value of the resolution target domain name based on the first risk value corresponding to the risky domain name resolution server and the second risk value corresponding to each associated domain name resolution server. Thus, the first risk value of the risky domain name resolution server is determined by the number of attacks and the type of attacks on the risky domain name resolution server in a preset period, which realizes a comprehensive assessment of the risk of the risky domain name resolution server, improves the accuracy of the risk assessment of the risky domain name resolution server, and thus improves the comprehensiveness and accuracy of the risk value of the resolution target domain name determined by the first risk value.

Description

Technical Field

[0001] The present disclosure relates to a domain name resolution security assessment technology, and in particular to a domain name resolution security detection method, device, electronic device, and storage medium. Background Art

[0002] The Domain Name System (DNS), a critical infrastructure of the internet, resolves domain names, enabling users to access the internet. Because the DNS is a massive hierarchical structure, its proper operation requires the participation of multiple servers responsible for domain name resolution. Therefore, if even one participating server node is attacked or fails during domain name resolution, it can cause a massive chain reaction, such as a multi-regional internet outage, impacting a large number of users.

[0003] In related technologies, domain name resolution security monitoring usually focuses on a certain type of threat to the server, such as distributed denial of service (DDoS) attacks or DNS hijacking. However, servers in the DNS can be subject to a variety of threats, which makes the security assessment of domain name resolution based on the monitoring results of the monitored servers incomplete, resulting in inaccurate security assessment of domain name resolution. Summary of the Invention

[0004] In order to solve the above technical problems, the embodiments of the present disclosure provide a domain name security detection method, device, electronic device and storage medium.

[0005] One aspect of an embodiment of the present disclosure provides a domain name resolution security detection method, comprising: in response to detecting an abnormal risk domain name resolution server in each target domain name resolution service, obtaining the number of attacks and / or the type of attacks on the risk domain name resolution server within a preset time period, the target domain name resolution server including each domain name resolution service corresponding to the target domain name, and / or each domain name resolution server corresponding to the alias corresponding to the target domain name; determining a first risk value of the risk domain name resolution server based on the number of attacks and / or the type of attacks corresponding to the risk domain name resolution server; determining at least one associated domain name in each domain name resolution server according to the target area name corresponding to the risk domain name resolution server; A resolution server, wherein each associated domain name resolution server in the at least one associated domain name resolution server is used to resolve a target area name, where the target area name is composed of at least one first-level domain name in the target domain name, or is composed of at least one first-level domain name in the alias; for each associated domain name resolution server, obtaining a weight value and an initial risk value respectively corresponding to the associated domain name resolution server; determining a second risk value corresponding to the associated domain name resolution server based on the weight value and the initial risk value respectively corresponding to the associated domain name resolution server; and determining a risk value for resolving the target domain name based on the first risk value corresponding to the risk domain name resolution server and the second risk values ​​respectively corresponding to each associated domain name resolution server.

[0006] Another aspect of the embodiments of the present disclosure provides a domain name resolution security detection device, including: a risk server determination module, for obtaining the number of attacks and / or the type of attacks on the risk domain name resolution server within a preset time period in response to detecting an abnormal risk domain name resolution server in each target domain name resolution service, wherein the target domain name resolution server includes each domain name resolution service corresponding to the target domain name, and / or each domain name resolution server corresponding to the alias corresponding to the target domain name; a first risk determination module, for determining a first risk value of the risk domain name resolution server based on the number of attacks and / or the type of attacks corresponding to the risk domain name resolution server; an association determination module, for determining at least one associated domain name in each domain name resolution server according to the target area name corresponding to the risk domain name resolution server A resolution server, wherein each associated domain name resolution server in the at least one associated domain name resolution server is used to resolve the target area name, and the target area name is composed of at least one first-level domain name in the target domain name, or is composed of at least one first-level domain name in the alias; a second risk determination module is used to obtain, for each associated domain name resolution server, the weight value and the initial risk value corresponding to the associated domain name resolution server; a third risk determination module is used to determine the second risk value corresponding to the associated domain name resolution server based on the weight value and the initial risk value corresponding to the associated domain name resolution server; a fourth risk determination module is used to determine the risk value of resolving the target domain name based on the first risk value corresponding to the risk domain name resolution server and the second risk value corresponding to each associated domain name resolution server.

[0007] Another aspect of the embodiments of the present disclosure provides an electronic device, including: a memory for storing a computer program; a processor for executing the computer program stored in the memory, and when the computer program is executed, the above-mentioned domain name resolution security detection method is implemented.

[0008] Another aspect of the embodiments of the present disclosure provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the above-mentioned domain name resolution security detection method.

[0009] In an embodiment of the present disclosure, when an abnormal risky domain name resolution server is detected in each target domain name resolution service, the number of attacks and / or the type of attacks on the risky domain name resolution server in a preset time period is obtained, and then a first risk value of the risky domain name resolution server is determined based on the number of attacks and / or the type of attacks corresponding to the risky domain name resolution server. Then, based on the target zone name corresponding to the risky domain name resolution server, at least one associated domain name resolution server is determined in each domain name resolution server, and a weight value and an initial risk value corresponding to each associated domain name resolution server are obtained. Based on the weight value and the initial risk value corresponding to each associated domain name resolution server, a second risk value corresponding to each associated domain name resolution server is determined. Based on the first risk value corresponding to the risky domain name resolution server and the second risk value corresponding to each associated domain name resolution server, a risk value of the target domain name is determined. Thus, in an embodiment of the present disclosure, the first risk value of the risky domain name resolution server is determined using the number of attacks and the type of attacks on the risky domain name resolution server in the preset time period, thereby achieving a comprehensive assessment of the risk of the risky domain name resolution server, improving the accuracy of the risk assessment of the risky domain name resolution server, and thereby improving the comprehensiveness and accuracy of the risk value of the target domain name resolved by the first risk value.

[0010] In addition, in the embodiment of the present disclosure, the associated domain name resolution server is determined by the target zone name corresponding to the risky domain name resolution server, and the risk value of the resolved target domain name is determined based on the second risk value corresponding to each associated domain name resolution server and the first risk value corresponding to the risky domain name. This ensures that when determining the risk value of the resolved target domain name, the risks of each domain name resolution server that resolves the target domain name are comprehensively considered, further improving the comprehensiveness and accuracy of the risk value of the resolved target domain name.

[0011] The technical solution of the present disclosure is further described in detail below through the accompanying drawings and examples. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments of the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0013] The present disclosure can be more clearly understood from the following detailed description with reference to the accompanying drawings, in which:

[0014] Figure 1 This is a flowchart of a domain name resolution security detection method provided by an exemplary embodiment of the present disclosure;

[0015] Figure 2 is a flowchart of step S120 provided by an exemplary embodiment of the present disclosure;

[0016] Figure 3is a flowchart of step S150 provided by an exemplary embodiment of the present disclosure;

[0017] Figure 4 is a domain name resolution dependency graph corresponding to a target domain name provided by an exemplary embodiment of the present disclosure;

[0018] Figure 5 It is a structural diagram of a domain name resolution security detection device provided by an exemplary embodiment of the present disclosure;

[0019] Figure 6 The figure is a schematic structural diagram of an application embodiment of the electronic device disclosed herein. DETAILED DESCRIPTION

[0020] Various exemplary embodiments of the present disclosure will now be described in detail with reference to the accompanying drawings. It should be noted that unless otherwise specifically stated, the relative arrangement of components and steps, numerical expressions and numerical values ​​set forth in these embodiments do not limit the scope of the present disclosure.

[0021] Those skilled in the art will understand that the terms "first" and "second" in the embodiments of the present disclosure are only used to distinguish different steps, devices or modules, and do not represent any specific technical meanings, nor do they indicate a necessary logical order between them.

[0022] It should also be understood that in the embodiments of the present disclosure, “a plurality of” may refer to two or more than two, and “at least one” may refer to one, two, or more than two.

[0023] It should also be understood that any component, data or structure mentioned in the embodiments of the present disclosure can generally be understood as one or more, unless explicitly limited or otherwise indicated in the context.

[0024] In addition, the term "and / or" in this disclosure is merely a description of the association relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone. In addition, the character " / " in this disclosure generally indicates that the related objects are in an "or" relationship.

[0025] It should also be understood that the description of the various embodiments in this disclosure focuses on the differences between the various embodiments, and the same or similar aspects thereof can be referenced with each other. For the sake of brevity, they will not be described one by one.

[0026] At the same time, it should be understood that for the convenience of description, the sizes of the various parts shown in the drawings are not drawn according to the actual proportional relationship.

[0027] The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way intended to limit the present disclosure, its application, or uses.

[0028] Technologies, methods, and equipment known to ordinary technicians in the relevant art may not be discussed in detail, but where appropriate, the technologies, methods, and equipment should be considered part of the specification.

[0029] It should be noted that like reference numerals and letters refer to like items in the following figures, and therefore, once an item is defined in one figure, it need not be further discussed in subsequent figures.

[0030] The embodiments of the present disclosure can be applied to electronic devices such as terminal devices, computer systems, and servers, and can operate in conjunction with numerous other general-purpose or specialized computing system environments or configurations. Examples of well-known terminal devices, computing systems, environments, and / or configurations suitable for use with terminal devices, computer systems, servers, and other electronic devices include, but are not limited to, personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, microprocessor-based systems, set-top boxes, programmable consumer electronics, network personal computers, minicomputer systems, mainframe computer systems, and distributed cloud computing technology environments including any of the above systems, among others.

[0031] Electronic devices such as terminal devices, computer systems, and servers can be described in the general context of computer system-executable instructions (such as program modules) executed by the computer system. Generally, program modules can include routines, programs, object programs, components, logic, data structures, and the like that perform specific tasks or implement specific abstract data types. Computer systems / servers can be implemented in distributed cloud computing environments, where tasks are performed by remote processing devices linked via a communications network. In distributed cloud computing environments, program modules can be located on local or remote computer system storage media, including storage devices.

[0032] Figure 1 This is a flowchart of a domain name resolution security detection method provided by an exemplary embodiment of the present disclosure. This embodiment can be applied to electronic devices, such as Figure 1 As shown, the domain name resolution security detection method includes the following steps:

[0033] Step S100: In response to detecting an abnormal risky domain name resolution server in each target domain name resolution service, the number of attacks and / or the type of attacks on the risky domain name resolution server within a preset period of time are obtained.

[0034] In this embodiment, the domain name resolution server that performs domain name resolution for the target domain name and the domain name resolution server that performs domain name resolution for the alias (CNAME) of the target domain name may be referred to as the target domain name resolution server. The alias of the target domain name is also a domain name.

[0035] The target domain name resolution server includes domain name resolution services corresponding to the target domain name and / or domain name resolution servers corresponding to the alias corresponding to the target domain name.

[0036] In one embodiment, the attack type is used to indicate the type of attack suffered by the target domain name resolution server. The attack type may include, for example, at least one of the following: DDoS, DNS hijacking, cross-site scripting (XSS) attack, session hijacking (Session Hijacking) attack, and malformed message attack (Teardrop attack), etc.

[0037] Each target domain name resolution server can be tested at preset intervals or before resolving the target domain name to determine whether the target domain name resolution server is abnormal. If a target domain name resolution server is determined to be abnormal, it will be identified as a risky domain name resolution server. Specifically, a target domain name resolution server can be identified as abnormal if it experiences abnormal traffic, performance degradation, or has not responded for a certain period of time.

[0038] Step S110: determining a first risk value of the risky domain name resolution server based on the number of attacks and / or the type of attacks corresponding to the risky domain name resolution server.

[0039] In the embodiment of the present disclosure, the risk value corresponding to the risky domain name resolution server may be referred to as a first risk value.

[0040] In one embodiment, a correspondence between the number of attacks and the score, and a correspondence between the attack type and the score can be preset. The target domain name resolution server can correspond to one attack type or multiple attack types.

[0041] Logs of the risky domain name resolution server can be obtained, and the number of attacks and the types of attacks on the target domain name resolution server within a preset time period can be obtained from the logs. A first score can be determined based on a correspondence between a preset number of attacks and scores, as well as the number of attacks on the risky domain name resolution server within the preset time period. A score corresponding to each attack type can be determined based on a preset correspondence between attack types and scores, as well as each attack type on the risky domain name resolution server within the preset time period. The sum of the scores corresponding to each attack type is used as a second score, and the sum of the first score and the second score is determined as a first risk value.

[0042] Step S120: determining at least one associated domain name resolution server from among the domain name resolution servers according to the target zone name corresponding to the risky domain name resolution server.

[0043] Among them, each associated domain name resolution server in the at least one associated domain name resolution server is used to resolve the target zone name; the target zone name is composed of at least one first-level domain name in the target domain name, or at least one first-level domain name in the alias.

[0044] The target domain name resolved by the risky domain name resolution server and / or the alias domain name may be determined as the target domain name.

[0045] A domain name is a method used to resolve Internet Protocol addresses (IP addresses) on the Internet. A complete domain name consists of two or more parts, separated by an English period ".". The part to the right of the last "." is called the top-level domain (TLD), also known as the first-level domain. The part to the left of the last "." is called the second-level domain (SLD), and the part to the left of the second-level domain is called the third-level domain. And so on. Each level of domain name controls the allocation of the next level of domain names.

[0046] The target domain name may include multiple region names, each region name is composed of at least one first-level domain name in the target domain name; the alias may include multiple region names, each region name is composed of at least one first-level domain name in the alias.

[0047] The domain name resolution server used to resolve the ancestor domain name of the target domain name can be determined as the associated domain name resolution server. The domain name resolution server that is responsible for resolving the IP address corresponding to a domain name is determined to be the ancestor domain name of the domain name, and the ancestor domain name includes the domain name.

[0048] For example, assume that the target domain name can be www.example1.com, and the alias of the target domain name can be www.example2.com; com is the top-level domain name, example1 and example2 are second-level domain names, and www is the third-level domain name. The regional names of the target domain name can include: com and example1.com, and the regional names of the alias can include: com and example2.com.

[0049] By resolving the domain name of com (the target zone name), we can obtain the IP addresses of the domain name resolution servers that resolve example1.com and example2.com. Therefore, example1.com and example2.com are both ancestor zone names of com. The domain name resolution servers that resolve example1.com and example2.com can be determined as associated domain name resolution servers.

[0050] Step S130: For each associated domain name resolution server, obtain the weight value and initial risk value corresponding to the associated domain name resolution server.

[0051] In one embodiment, a correspondence between a preset domain name resolution server and a weight value may be preset, and the weight value corresponding to the associated domain name resolution server may be determined according to the correspondence between the preset domain name resolution server and the weight value.

[0052] The initial risk value corresponding to the associated domain name resolution server may be determined according to the number of times the associated domain name resolution server is attacked within a preset period of time and the corresponding relationship between the preset number of attacks and the score.

[0053] Step S140: Determine a second risk value corresponding to the associated domain name resolution server based on the weight value and the initial risk value respectively corresponding to the associated domain name resolution server.

[0054] In the embodiment of the present disclosure, the risk value corresponding to the associated domain name resolution server may be referred to as a second risk value.

[0055] The product of the weight value and the initial risk value may be determined as the second risk value corresponding to the associated domain name resolution server.

[0056] Step S150: determining a risk value of the target domain name to be resolved based on the first risk value corresponding to the risky domain name resolution server and the second risk values ​​corresponding to each associated domain name resolution server.

[0057] The risk value of resolving the target domain name may be used to indicate the risk situation of resolving the target domain name.

[0058] In one embodiment, the sum of the first risk value and each second risk value may be determined as the risk value of resolving the target domain name.

[0059] In one embodiment, when the ancestor zone name of the target zone name is the target domain name or an alias, the first risk value may be determined as the risk value of resolving the target domain name. For example, for the target domain name www.example1.com, domain name resolution of example1.com (the target zone name) yields the IP address of the domain name resolution server that resolves www.example1.com. Therefore, www.example1.com is the ancestor zone name of example1.com. In this case, the ancestor zone name of example1.com is the target domain name, and the first risk value is determined as the risk value of resolving the target domain name.

[0060] In the embodiment of the present disclosure, the first risk value of the risky domain name resolution server is determined by using the number of attacks and the type of attacks on the risky domain name resolution server in a preset time period, thereby achieving a comprehensive assessment of the risk of the risky domain name resolution server and improving the accuracy of the risk assessment of the risky domain name resolution server, thereby improving the comprehensiveness and accuracy of the risk value of the target domain name resolved by the first risk value. In addition, in the embodiment of the present disclosure, the associated domain name resolution server is determined by the target zone name corresponding to the risky domain name resolution server, and the risk value of the target domain name resolved is determined based on the second risk value corresponding to each associated domain name resolution server and the first risk value corresponding to the risky domain name. This achieves that when determining the risk value of the target domain name resolved, the risks of each domain name resolution server that resolves the target domain name are comprehensively considered, further improving the comprehensiveness and accuracy of the risk value of the target domain name resolved.

[0061] Figure 2 FIG. 1 is a flow chart of step S120 provided by an exemplary embodiment of the present disclosure. In some optional implementations, step S120 may include the following steps:

[0062] Step S121: Obtain domain name resolution information corresponding to the target domain name.

[0063] The domain name resolution information includes: the resolution relationship between the zone name and the domain name resolution server, and the dependency relationship between the zone names.

[0064] The resolution relationship between a zone name and a domain name resolution server is used to represent the resolution relationship of the domain name resolution server to the zone name; the dependency relationship between zone names is used to represent the corresponding relationship between a zone name and its ancestor zone.

[0065] Step S122: determining the target area name based on the risky domain name resolution server and the resolution relationship between the area name and the domain name resolution server.

[0066] Wherein, based on the resolution relationship between the zone name and the domain name resolution server, the zone name resolved by the risky domain name resolution server is determined, and the zone name is determined as the target zone name.

[0067] Step S123: determining associated domain name resolution servers based on the target zone name, the resolution relationship between the zone name and the domain name resolution server, and the dependency relationship between the zone names.

[0068] Among them, the ancestor region name of the target region name can be determined based on the dependency relationship between the target region name and the region name, and then the domain name resolution servers used to resolve the ancestor region name can be determined based on the ancestor region name and the resolution relationship between the region name and the domain name resolution server, and the domain name resolution servers can be determined as associated domain name resolution servers.

[0069] In some optional embodiments, in the implementation of the present disclosure, step S130 may include: for each associated domain name resolution server, obtaining the number of attacks and / or the type of attacks on the associated domain name resolution server within a preset period of time, and then determining the initial risk value corresponding to the associated domain name resolution server based on the number of attacks and / or the type of attacks corresponding to the associated domain name resolution server.

[0070] In one embodiment, the associated domain name resolution server may correspond to one attacked type or multiple attacked types.

[0071] A log of the associated domain name resolution server can be obtained, and the number of attacks and the types of attacks on the associated domain name resolution server within a preset time period can be obtained based on the log. A third score can be determined based on a correspondence between a preset number of attacks and a score, and the number of attacks on the associated domain name resolution server within the preset time period. A score corresponding to each attack type can be determined based on a correspondence between a preset attack type and a score, and the types of attacks on the associated domain name resolution server within the preset time period. The sum of the scores corresponding to each attack type is used as a fourth score, and the sum of the third and fourth scores is determined as the initial risk value corresponding to the associated domain name resolution server.

[0072] In some optional implementations, in the implementation of the present disclosure, step S130 may further include: determining a weight value corresponding to the associated domain name resolution server according to a correspondence between a preset domain name resolution server and a weight value.

[0073] The correspondence between the preset domain name resolution servers and the weight values ​​includes weight values ​​corresponding to a plurality of domain name resolution servers. The weight value corresponding to each associated domain name resolution server can be determined based on the correspondence between the preset domain name resolution servers and the weight values.

[0074] Figure 3FIG. 1 is a flow chart of step S150 provided by an exemplary embodiment of the present disclosure. In some optional implementations, step S150 may include the following steps:

[0075] Step S151: determining an associated risk value based on the second risk value corresponding to each associated domain name resolution server.

[0076] Among them, when each associated domain name resolution server resolves the same zone name, the associated risk value can be determined by formula (1);

[0077] Formula (1)

[0078] R1 to Rn in formula (1) represent the second risk value of the first associated domain name resolution server to the second risk value of the nth associated domain name resolution server, respectively, and n is an integer greater than 2.

[0079] When the associated domain name resolution server resolves two or more zone names, the associated domain name resolution servers that resolve the same zone name can be set in a set, and the intermediate risk value corresponding to each set is calculated using formula (1) and the second risk value corresponding to each associated domain name resolution server in each set. Then, based on each intermediate risk value, the associated risk value is calculated using formula (2).

[0080] Formula (2)

[0081] M1~Mn in formula (2) represent the first intermediate risk value to the nth intermediate risk value respectively.

[0082] For example, the example in step S120 is used for illustration. Assuming that the domain name resolution servers for resolving example1.com are domain name resolution server 1 and domain name resolution server 2, and the domain name resolution servers for resolving example2.com are domain name resolution server 3 and domain name resolution server 4, the associated domain name resolution servers include resolution server 1 to resolution server 4.

[0083] According to the second risk values ​​corresponding to domain name resolution server 1 and domain name resolution server 2, respectively, the first intermediate risk value is calculated using formula (1). According to the second risk values ​​corresponding to domain name resolution server 3 and domain name resolution server 4, respectively, the second intermediate risk value is calculated using formula (1). According to the first intermediate risk value and the second intermediate risk value, the associated risk value is calculated using formula (2).

[0084] Step S152: determining the risk value of resolving the target domain name based on the associated risk value and the first risk value.

[0085] In one embodiment, the sum of the first risk value and the associated risk value may be determined as the risk value of resolving the target domain name.

[0086] In some optional embodiments, the domain name resolution security detection method in the embodiment of the present disclosure may also include: in response to the target domain name corresponding to the alias, using the target domain name, the regional names and domain name resolution servers corresponding to the target domain name, and the alias, the regional names and domain name resolution servers corresponding to the alias as nodes, and using the resolution relationship between the regional name and the domain name resolution server, the correspondence between the target domain name and the alias, and the dependency relationship between the regional names as edges, to generate a domain name resolution dependency graph corresponding to the target domain name.

[0087] In one embodiment, domain name resolution processing may be performed on the target domain name to obtain a domain name resolution message of the target domain name, and a node list and an edge list may be created.

[0088] When the answer segment in the message includes a CNAME record, it is determined that the target domain name has an alias, the alias is obtained from the CNAME record, and the regional names corresponding to the target domain name, the regional names corresponding to the alias, the domain name resolution servers that resolve the regional names corresponding to the target domain name, and the domain name resolution servers that resolve the regional names corresponding to the alias are obtained from the authorization field in the message. The target domain name, the alias, the regional names corresponding to the target domain name, the regional names corresponding to the alias, the domain name resolution servers that resolve the regional names corresponding to the target domain name, and the domain name resolution servers that resolve the regional names corresponding to the alias are recorded as nodes in the node list;

[0089] An edge is established between each zone name and the domain name resolution server that resolves it, using the resolution relationship between the zone name and the domain name resolution server as the edge, and recorded in the edge table. An edge is established between the target domain name and the alias, using the corresponding relationship between the target domain name and the alias as the edge, and recorded in the edge table. An edge is established between each zone name and its ancestor zone name, using the dependency relationship between zone names as the edge, and recorded in the edge table. Using the node list and edge list, a domain name resolution dependency graph corresponding to the target domain name is created.

[0090] For example, Figure 4This is a domain name resolution dependency graph corresponding to a target domain name provided by an exemplary embodiment of the present disclosure. www.example1.com is the target domain name, www.example2.com is an alias of the target domain name, com, example1.com, and example2.com are zone names, a1 through an are domain name resolution servers that resolve the zone name example1.com, b1 through bn are domain name resolution servers that resolve the zone name example2.com, and c1 through cn are domain name resolution servers that resolve the zone name com. PDD represents the dependency relationship between zone names, and NS represents a domain name resolution server.

[0091] In an optional embodiment, in an embodiment of the present disclosure, in response to the target domain name not having a corresponding alias, a domain name resolution dependency graph corresponding to the target domain name is generated with the target domain name, the regional names corresponding to the target domain name, and the domain name resolution servers as nodes, and the resolution relationship between the regional name and the domain name resolution server, the correspondence between the target domain name and the alias, and the dependency relationship between the regional names as edges.

[0092] The method for generating a domain name resolution dependency graph that does not include aliases may refer to the above-mentioned method for generating a domain name resolution dependency graph that includes aliases, and will not be described in detail here.

[0093] Accordingly, in the disclosed embodiment, step S121 may include: determining domain name resolution information corresponding to the target domain name based on a domain name resolution dependency graph corresponding to the target domain name.

[0094] In some optional implementations, the domain name resolution security detection method in the embodiment of the present disclosure may further include: performing an alarm process in response to a risk value of resolving the target domain name exceeding a preset risk threshold.

[0095] Among them, a preset risk threshold can be set in advance. When the risk value of the resolved target domain name exceeds the preset risk threshold, an alarm process can be performed to provide a prompt. When the risk value of the resolved target domain name does not exceed the preset risk threshold, no process is performed.

[0096] Figure 5 FIG. 1 is a structural diagram of a domain name resolution security detection device provided by an exemplary embodiment of the present disclosure. Figure 5 As shown, the device of this embodiment may include:

[0097] The risk server determination module 200 is configured to, in response to detecting an abnormal risky domain name resolution server in each target domain name resolution service, obtain the number of attacks and / or the type of attacks on the risky domain name resolution server within a preset period of time, wherein the target domain name resolution servers include domain name resolution services corresponding to the target domain name and / or domain name resolution servers corresponding to aliases corresponding to the target domain name;

[0098] A first risk determination module 210 is configured to determine a first risk value of the risky domain name resolution server based on the number of attacks and / or the type of attacks corresponding to the risky domain name resolution server;

[0099] an association determination module 220 for determining, based on the target zone name corresponding to the risky domain name resolution server, at least one associated domain name resolution server from among the domain name resolution servers, each of the at least one associated domain name resolution server being configured to resolve the target zone name, the target zone name being composed of at least one first-level domain name in the target domain name, or at least one first-level domain name in the alias;

[0100] The second risk determination module 230 is configured to obtain, for each associated domain name resolution server, a weight value and an initial risk value corresponding to the associated domain name resolution server;

[0101] A third risk determination module 240 is configured to determine a second risk value corresponding to the associated domain name resolution server based on the weight value and the initial risk value respectively corresponding to the associated domain name resolution server;

[0102] The fourth risk determination module 250 is configured to determine a risk value of resolving the target domain name based on the first risk value corresponding to the risky domain name resolution server and the second risk values ​​corresponding to each associated domain name resolution server.

[0103] In some possible implementations of the present disclosure, the association determination module 220 includes:

[0104] The first submodule is configured to obtain domain name resolution information corresponding to the target domain name, wherein the domain name resolution information includes a resolution relationship between a zone name and a domain name resolution server, and a dependency relationship between zone names;

[0105] A second submodule is configured to determine the target area name based on the risk domain name resolution server and the resolution relationship between the area name and the domain name resolution server;

[0106] The third submodule is configured to determine the associated domain name resolution servers based on the target zone name, the resolution relationship between the zone name and the domain name resolution server, and the dependency relationship between the zone names.

[0107] In some possible implementations of the present disclosure, obtaining an initial risk value corresponding to the associated domain name resolution server is further used to:

[0108] Obtaining the number of attacks and / or the type of attacks on the associated domain name resolution server within a preset period of time;

[0109] The initial risk value is determined based on the number of attacks and / or the type of attacks corresponding to the associated domain name resolution server.

[0110] In some possible implementations of the present disclosure, obtaining a weight value corresponding to the associated domain name resolution server is further used to:

[0111] The weight value corresponding to the associated domain name resolution server is determined according to the corresponding relationship between the preset domain name resolution server and the weight value.

[0112] In some possible implementations of the present disclosure, the fourth risk determination module 250 is specifically used to: determine an associated risk value based on the second risk value corresponding to each associated domain name resolution server; and determine a risk value for resolving the target domain name based on the associated risk value and the first risk value.

[0113] In some possible implementations of the present disclosure, the apparatus further includes:

[0114] a first image generation module, configured to generate, in response to the target domain name corresponding to the alias, a domain name resolution dependency graph corresponding to the target domain name, using the target domain name, each region name and each domain name resolution server corresponding to the target domain name, and the alias, each region name and each domain name resolution server corresponding to the alias as nodes, and using resolution relationships between region names and domain name resolution servers, correspondences between the target domain name and the alias, and dependencies between region names as edges;

[0115] a second image generation module, configured to generate, in response to the target domain name not corresponding to the alias, a domain name resolution dependency graph corresponding to the target domain name, using the target domain name, each zone name corresponding to the target domain name, and each domain name resolution server as nodes, and using resolution relationships between zone names and domain name resolution servers, correspondence relationships between the target domain name and the alias, and dependency relationships between zone names as edges;

[0116] The first submodule is specifically configured to determine the domain name resolution information corresponding to the target domain name based on a domain name resolution dependency graph corresponding to the target domain name.

[0117] In some possible implementations of the present disclosure, the apparatus further includes:

[0118] The alarm module is used to perform alarm processing in response to the risk value of resolving the target domain name exceeding a preset risk threshold.

[0119] The domain name resolution security detection device of the embodiment of the present disclosure corresponds to the embodiment of the domain name resolution security detection method of the present disclosure. The relevant contents can be referenced to each other and will not be repeated here.

[0120] The beneficial technical effects corresponding to the exemplary embodiments of the domain name resolution security detection device of the embodiments of the present disclosure can be found in the corresponding beneficial technical effects of the above-mentioned corresponding exemplary method part, which will not be repeated here.

[0121] In addition, an embodiment of the present disclosure further provides an electronic device, including:

[0122] memory for storing computer programs;

[0123] The processor is configured to execute the computer program stored in the memory, and when the computer program is executed, the domain name resolution security detection method described in any one of the above embodiments of the present disclosure is implemented.

[0124] Figure 6 This is a schematic diagram of the structure of an application embodiment of the electronic device disclosed in the present invention. Figure 6 The electronic device according to the embodiment of the present disclosure is described. The electronic device may be either or both of the first device and the second device, or a standalone device independent of them, and the standalone device may communicate with the first device and the second device to receive collected input signals from them.

[0125] like Figure 6 As shown, the electronic device includes one or more processors and memory.

[0126] The processor may be a central processing unit (CPU) or other forms of processing units having data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device to perform desired functions.

[0127] The memory may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory. The non-volatile memory may include, for example, read-only memory (ROM), a hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor may execute the program instructions to implement the domain name resolution security detection method of each embodiment of the present disclosure described above and / or other desired functions.

[0128] In one example, the electronic device may further include an input device and an output device, and these components are interconnected via a bus system and / or other forms of connection mechanisms (not shown).

[0129] In addition, the input device may also include, for example, a keyboard, a mouse, and the like.

[0130] The output device can output various information to the outside, including determined distance information, direction information, etc. The output device can include, for example, a display, a speaker, a printer, a communication network and a remote output device connected thereto, and the like.

[0131] Of course, to simplify, Figure 6 Only some of the components related to the present disclosure in the electronic device are shown, and components such as a bus, an input / output interface, etc. are omitted. In addition, the electronic device may further include any other appropriate components according to specific application scenarios.

[0132] In addition to the above-mentioned methods and devices, an embodiment of the present disclosure may also be a computer program product, which includes computer program instructions, which, when executed by a processor, enable the processor to execute the steps of the domain name resolution security detection method according to various embodiments of the present disclosure described in the above part of this specification.

[0133] The computer program product may be written in any combination of one or more programming languages ​​to implement the operations of the disclosed embodiments, including object-oriented programming languages ​​such as Java, C++, and conventional procedural programming languages ​​such as C or similar programming languages. The program code may be executed entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0134] In addition, an embodiment of the present disclosure may also be a computer-readable storage medium having computer program instructions stored thereon, which, when executed by a processor, enables the processor to execute the steps of the domain name resolution security detection method according to various embodiments of the present disclosure described in the above part of this specification.

[0135] The computer-readable storage medium may be any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may include, for example, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0136] Those skilled in the art will understand that all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk, etc. Various media that can store program codes.

[0137] The basic principles of the present disclosure have been described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, and effects mentioned in this disclosure are merely illustrative and not restrictive, and should not be construed as necessarily possessed by each embodiment of the present disclosure. Furthermore, the specific details disclosed above are provided for illustrative purposes and to facilitate understanding, rather than as limitations. These details do not limit the present disclosure to necessarily being implemented using these specific details.

[0138] Each embodiment in this specification is described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. References to the same or similar parts between the various embodiments are sufficient. For system embodiments, since they largely correspond to method embodiments, their description is relatively simple. For relevant parts, references to the description of the method embodiments are sufficient.

[0139] The block diagrams of the devices, devices, equipment, and systems involved in this disclosure are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As will be appreciated by those skilled in the art, these devices, devices, equipment, and systems can be connected, arranged, or configured in any manner. Words such as "include," "comprise," "have," and the like are open-ended words, meaning "including but not limited to," and can be used interchangeably therewith. The words "or" and "and" used herein refer to the words "and / or" and can be used interchangeably therewith, unless the context clearly indicates otherwise. The word "such as" used herein refers to the phrase "such as but not limited to," and can be used interchangeably therewith.

[0140] The methods and apparatus of the present disclosure may be implemented in many ways. For example, the methods and apparatus of the present disclosure may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above order of steps for the method is for illustration only, and the steps of the method of the present disclosure are not limited to the order specifically described above unless otherwise specified. In addition, in some embodiments, the present disclosure may also be implemented as programs recorded in a recording medium, which include machine-readable instructions for implementing the methods according to the present disclosure. Thus, the present disclosure also covers recording media that store programs for executing the methods according to the present disclosure.

[0141] It should also be noted that in the apparatus, device, and method of the present disclosure, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present disclosure.

[0142] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the aspects shown herein, but rather to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0143] The above description has been provided for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although a number of example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations thereof.

Claims

1. A domain name resolution security detection method, characterized in that: include: In response to detecting an abnormal risky domain name resolution server in each target domain name resolution server, obtaining the number of attacks and / or the attack type of the risky domain name resolution server in a preset period of time, the target domain name resolution server includes each domain name resolution server corresponding to the target domain name, and / or each domain name resolution server corresponding to the alias corresponding to the target domain name; Determine a first risk value of the risky domain name resolution server based on the number of attacks and / or the type of attacks corresponding to the risky domain name resolution server; Determining at least one associated domain name resolution server among the domain name resolution servers according to the target zone name corresponding to the risk domain name resolution server, including obtaining domain name resolution information corresponding to the target domain name, the domain name resolution information including a resolution relationship between a zone name and a domain name resolution server, and a dependency relationship between zone names; Determine the target area name based on the risk domain name resolution server and the resolution relationship between the area name and the domain name resolution server; According to the dependency relationship between the target area name and the area name, the ancestor area name of the target area name is determined; according to the ancestor area name and the resolution relationship between the area name and the domain name resolution server, each domain name resolution server used to resolve the ancestor area name is determined as an associated domain name resolution server; the area name that is responsible for resolving a domain name resolution server corresponding to an Internet Protocol address obtained by resolving a area name is determined as the ancestor area name of the area name; the dependency relationship between the area names represents the corresponding relationship between the area name and its ancestor area; each associated domain name resolution server in the at least one associated domain name resolution server is used to resolve the target area name, and the target area name is composed of at least one first-level domain name in the target domain name, or is composed of at least one first-level domain name in the alias; For each of the associated domain name resolution servers, obtaining a weight value and an initial risk value respectively corresponding to the associated domain name resolution server; Determine a second risk value corresponding to the associated domain name resolution server based on the weight values ​​and initial risk values ​​respectively corresponding to the associated domain name resolution servers; The risk value of resolving the target domain name is determined based on the first risk value corresponding to the risky domain name resolution server and the second risk values ​​respectively corresponding to each associated domain name resolution server.

2. The method according to claim 1, characterized in that Obtaining an initial risk value corresponding to the associated domain name resolution server includes: Obtaining the number of attacks and / or the type of attacks on the associated domain name resolution server within a preset period of time; The initial risk value is determined based on the number of attacks and / or the type of attacks corresponding to the associated domain name resolution server.

3. The method according to claim 2, characterized in that Obtaining the weight value corresponding to the associated domain name resolution server includes: According to the correspondence between the preset domain name resolution server and the weight value, the weight value corresponding to the associated domain name resolution server is determined.

4. The method according to claim 1, characterized in that: The determining the risk value of resolving the target domain name based on the first risk value corresponding to the risky domain name resolution server and the second risk values ​​respectively corresponding to each associated domain name resolution server includes: Determining an associated risk value based on the second risk value corresponding to each associated domain name resolution server; A risk value for resolving the target domain name is determined based on the associated risk value and the first risk value.

5. The method according to claim 1, characterized in that Also includes: In response to the target domain name corresponding to the alias, a domain name resolution dependency graph corresponding to the target domain name is generated with the target domain name, each area name and each domain name resolution server corresponding to the target domain name, and the alias, each area name and each domain name resolution server corresponding to the alias as nodes, and with the resolution relationship between the area name and the domain name resolution server, the corresponding relationship between the target domain name and the alias, and the dependency relationship between the area names as edges; In response to the target domain name not corresponding to the alias, a domain name resolution dependency graph corresponding to the target domain name is generated, with the target domain name, each zone name corresponding to the target domain name, and each domain name resolution server as nodes, and with the resolution relationship between the zone name and the domain name resolution server, the correspondence relationship between the target domain name and the alias, and the dependency relationship between the zone names as edges; The obtaining of the domain name resolution information corresponding to the target domain name includes: Based on the domain name resolution dependency graph corresponding to the target domain name, domain name resolution information corresponding to the target domain name is determined.

6. The method according to any one of claims 1 to 5, characterized in that: Also includes: In response to the risk value of parsing the target domain name exceeding a preset risk threshold, an alarm process is performed.

7. A domain name resolution security detection device, characterized in that: include: A risk server determination module is used to obtain the number of attacks and / or the type of attacks on the risky domain name resolution server in a preset period of time in response to detecting an abnormal risky domain name resolution server in each target domain name resolution server, wherein the target domain name resolution server includes each domain name resolution server corresponding to the target domain name and / or each domain name resolution server corresponding to the alias corresponding to the target domain name; A first risk determination module, configured to determine a first risk value of the risky domain name resolution server based on the number of attacks and / or the type of attacks corresponding to the risky domain name resolution server; an association determination module, configured to determine at least one associated domain name resolution server among the domain name resolution servers according to the target zone name corresponding to the risk domain name resolution server, wherein each associated domain name resolution server among the at least one associated domain name resolution server is configured to resolve the target zone name, and the target zone name is composed of at least one first-level domain name in the target domain name, or is composed of at least one first-level domain name in the alias; A second risk determination module is used to obtain, for each associated domain name resolution server, a weight value and an initial risk value respectively corresponding to the associated domain name resolution server; A third risk determination module, configured to determine a second risk value corresponding to the associated domain name resolution server based on the weight values ​​and initial risk values ​​respectively corresponding to the associated domain name resolution servers; A fourth risk determination module, configured to determine a risk value of resolving the target domain name based on a first risk value corresponding to the risky domain name resolution server and second risk values ​​respectively corresponding to each associated domain name resolution server; The association determination module includes: a first submodule, used to obtain domain name resolution information corresponding to the target domain name, the domain name resolution information includes a resolution relationship between the area name and the domain name resolution server, and a dependency relationship between the area names; a second submodule, used to determine the target area name based on the risk domain name resolution server and the resolution relationship between the area name and the domain name resolution server; a third submodule, used to determine the associated domain name resolution servers based on the target area name, the resolution relationship between the area name and the domain name resolution server, and the dependency relationship between the area names, including: determining the ancestor area name of the target area name according to the dependency relationship between the target area name and the area name, determining the domain name resolution servers used to resolve the ancestor area name as the associated domain name resolution servers according to the ancestor area name and the resolution relationship between the area name and the domain name resolution server, determining the area name that is responsible for resolving the domain name resolution server corresponding to the Internet Protocol address obtained by resolving a area name as the ancestor area name of the area name, and the dependency relationship between the area names represents the corresponding relationship between the area name and its ancestor area.

8. An electronic device, characterized in that: include: Memory for storing computer programs; The processor is used to execute the computer program stored in the memory, and when the computer program is executed, the domain name resolution security detection method described in any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the domain name resolution security detection method described in any one of claims 1 to 6 is implemented.

Images